CVE-2011-2718 json
phpMyAdmin Directory Traversal Vulnerability
published 2011-08-01 15 y ago modified 2026-06-16 4 mo ago also GHSA-xhqq-554j-p4x8 , EUVD-2022-5801
- cvss
- 6.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
Patch / fix
- packagist phpmyadmin/phpmyadmin 3.4.3.2
- phpmyadmin Debian 14, Debian 13, Debian 12 4:3.4.3.2-1
debian advisories DEBIAN-CVE-2011-2718
- github.com/phpmyadmin/phpmyadmin@3ae58f0 commit
- phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=3ae58f0c… commit
- openwall.com/lists/oss-security/2011/07/26/10 patch
- bugzilla.redhat.com/show_bug.cgi?id=725383 patch
- openwall.com/lists/oss-security/2011/07/25/4 patch
- phpmyadmin.net/home_page/security/PMASA-2011-11.php advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2011-2718 updated cvss 3.2
phpMyAdmin: v3.3.10.3, v3.4.3.2: Local file inclusion and code execution in 'relational schema' code (PMASA-2011-11)
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.68% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | phpmyadmin/phpmyadmin | >=3.4, <3.4.3.2 |
3.4.3.2 |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
openwall.com
/lists/oss-security/2011/07/26/10
mailing-list, web, patch
-
bugzilla.redhat.com
/show_bug.cgi?id=725383
web, patch
-
phpmyadmin.net
/home_page/security/PMASA-2011-11.php
web, patch, vendor-advisory
-
openwall.com
/lists/oss-security/2011/07/25/4
mailing-list, web, patch
-
github.com
/phpmyadmin/phpmyadmin/commit/3ae58f0cd6b89ad4767920f9b214c38d3f6d4393
web
-
phpmyadmin.git.sourceforge.net
/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393
web
-
mandriva.com
/security/advisories?name=MDVSA-2011:124
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2011-August/063410.html
vendor-advisory, web
-
lists.fedoraproject.org
/pipermail/package-announce/2011-August/063418.html
vendor-advisory, web
-
secunia.com
/advisories/45365
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/45515
third-party-advisory
-
osvdb.org
/74111
vdb-entry
-
securityfocus.com
/bid/48874
vdb-entry
-
phpmyadmin.git.sourceforge.net
/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393
web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/68768
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2011-2718
advisory
-
github.com
/phpmyadmin/composer
package
-
web.archive.org
/web/20120111084137/http://www.securityfocus.com/bid/48874
web
-
web.archive.org
/web/20121105034518/http://www.mandriva.com/en/support/security/advisories?name=MDVSA-2011:124
web
Sources
- CVE List CVE-2011-2718
- GitHub Advisory GHSA-xhqq-554j-p4x8
- NVD CVE-2011-2718
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.