CVE-2025-27410

Katalog CVE

CVSS 6.5 · Medium EPSS 2,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada pwndoc project pwndoc. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.

Rincian

Terbit di NVD

28 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pwndoc/pwndoc/security/advisories/GHSA-mxw8-vgvx-89hx exploit · advisory vendor
• https://github.com/pwndoc/pwndoc/commit/98f284291d73d3a0b11d3181d845845c192d1080 patch
• https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L5... product
• https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0 release notes