CVE-2025-50735

Katalog CVE

CVSS 7.5 · High EPSS 0,92%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada nextchat. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints.

Rincian

Terbit di NVD

3 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50735 exploit · advisory pihak ketiga
• https://github.com/ChatGPTNextWeb/NextChat/blob/main/app/api/webdav/%5B...path%5D/route.ts product
• https://github.com/ChatGPTNextWeb/NextChat/blob/main/app/utils/cloud/webdav.ts product