CVE-2025-63414

Katalog CVE

CVSS 10.0 · Critical EPSS 1,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada allskyteam allsky. Skor CVSS 3.1 10.0 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414/ exploit · advisory pihak ketiga
• https://github.com/AllskyTeam/allsky product
• https://github.com/AllskyTeam/allsky/blob/master/html/execute.php product