CVE-2025-46559

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada misskey. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with `../` to step out of the `/api` directory, thereby being able to make requests to other endpoints, such as `/files`, `/url`, and `/proxy`. Version 2025.4.1 fixes the issue.

Rincian

Terbit di NVD

5 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-gmq6-738q-vjp2 exploit · advisory vendor
• https://github.com/misskey-dev/misskey/commit/583df3ec63e25a1fd34def0dac13405396b8b663 patch