Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-whys-bh9f-9ygv
Vulnerability ID VCID-whys-bh9f-9ygv
Aliases CVE-2018-17567
GHSA-4xjh-m3qx-49wc
Summary Jekyll allows attackers to access arbitrary files by specifying a symlink
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0043 https://api.first.org/data/v1/epss?cve=CVE-2018-17567
epss 0.0043 https://api.first.org/data/v1/epss?cve=CVE-2018-17567
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-4xjh-m3qx-49wc
cvssv3.1 7.5 https://github.com/jekyll/jekyll
generic_textual HIGH https://github.com/jekyll/jekyll
cvssv3.1 7.5 https://github.com/jekyll/jekyll/pull/7224
generic_textual HIGH https://github.com/jekyll/jekyll/pull/7224
cvssv3.1 7.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jekyll/CVE-2018-17567.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jekyll/CVE-2018-17567.yml
cvssv3.1 7.5 https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8
generic_textual HIGH https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8
cvssv3 7.5 https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/
cvssv3.1 7.5 https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984@%3Ccommits.accumulo.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984@%3Ccommits.accumulo.apache.org%3E
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-17567
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-17567
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-17567
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17567
https://github.com/jekyll/jekyll
https://github.com/jekyll/jekyll/pull/7224
https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8
https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/
https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984@%3Ccommits.accumulo.apache.org%3E
909933 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909933
CVE-2018-17567 https://nvd.nist.gov/vuln/detail/CVE-2018-17567
CVE-2018-17567.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jekyll/CVE-2018-17567.yml
GHSA-4xjh-m3qx-49wc https://github.com/advisories/GHSA-4xjh-m3qx-49wc
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jekyll/jekyll
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jekyll/jekyll/pull/7224
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jekyll/CVE-2018-17567.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984@%3Ccommits.accumulo.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-17567
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.62977
EPSS Score 0.0043
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:24:19.137581+00:00 GHSA Importer Import https://github.com/advisories/GHSA-4xjh-m3qx-49wc 38.6.0