CVE-2025-6278

Katalog CVE

CVSS 9.8 · Critical EPSS 0,79%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada upsonic. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

19 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 54,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.313282 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.593096 advisory pihak ketiga · vdb entry
• https://github.com/Upsonic/Upsonic/issues/356 exploit
• https://vuldb.com/?ctiid.313282 permissions required · vdb entry