CVE-2025-67004

Katalog CVE

CVSS 6.5 · Medium EPSS 6,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada couchcms. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly. NOTE: A community member states that this is not a CouchCMS vulnerability and that if /\<file> is accessible it is a web-server configuration issue.

Rincian

Terbit di NVD

9 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

6,1% peluang dieksploitasi; lebih tinggi dari 93,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/thepiyushkumarshukla/d01f8004c43692f18c75548f4739955a exploit · advisory pihak ketiga
• https://github.com/CouchCMS/CouchCMS product
• https://www.couchcms.com/ product