CVE-2025-8729

Katalog CVE

CVSS 9.1 · Critical EPSS 0,76%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada migoxlab lmeterx. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the file backend/service/upload_service.py. The manipulation of the argument task_id leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is f1b00597e293d09452aabd4fa57f3185207350e8. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

8 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MigoXLab/LMeterX/commit/f1b00597e293d09452aabd4fa57f3185207350e8 patch
• https://github.com/MigoXLab/LMeterX/issues/10 exploit · issue tracking · patch
• https://github.com/MigoXLab/LMeterX/issues/10#issue-3255375024 exploit · issue tracking · patch
• https://github.com/MigoXLab/LMeterX/issues/10#issuecomment-3136380379 exploit · issue tracking · patch
• https://vuldb.com/?id.319225 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.621741 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.319225 permissions required · vdb entry