CVE-2025-12203

Katalog CVE

CVSS 4.9 · Medium EPSS 0,40%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada vvveb. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

Rincian

Terbit di NVD

27 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/givanz/Vvveb/commit/b0fa7ff74a3539c6d37000db152caad572e4c39b patch
• https://vuldb.com/?id.329873 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.673159 advisory pihak ketiga · vdb entry
• https://github.com/givanz/Vvveb/issues/333 exploit · issue tracking
• https://github.com/givanz/Vvveb/
• https://vuldb.com/?ctiid.329873 permissions required · vdb entry