CVE-2020-37214: Directory Traversal in Voyager CMS

Successful exploitation of CVE-2020-37214 grants an attacker the ability to read arbitrary files on the server. This includes critical configuration files like .env which may contain database credentials, API keys, and other sensitive information. Access to files such as /etc/passwd could expose user account details. The blast radius extends to the entire server, as the attacker can potentially gain control over the application and underlying system. This vulnerability shares similarities with other directory traversal exploits where attackers leverage predictable path structures to bypass access controls.

1. Reserved2026-02-10
2. Published2026-02-11
3. Modified2026-04-07
4. EPSS updated2026-03-23

The primary mitigation for CVE-2020-37214 is to upgrade Voyager CMS to version 1.3.1 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path manipulations in the asset parameter. Restrict file system access permissions to the Voyager CMS installation directory to limit the potential damage from a successful exploit. Monitor access logs for unusual file access patterns, particularly requests targeting sensitive files.