CVE-2025-15066 MEDIUM

CVE-2025-15066: Arbitrary File Download through Path Traversal in Innorix WP

Weakness CWE-22 · Path traversal

Published December 29, 2025

Last update December 29, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This issue affects Innorix WP from All versions If the "exam" directory exists under the directory where the product is installed (ex: innorix/exam)

Key dates

02Disclosure timeline

December 29, 2025 CVE published

December 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-15066 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2026-13369 Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter CVE-2026-28701 Daktronics Controller Firmware Path Traversal CVE-2026-20191 Cisco Catalyst Center Arbitrary File Read Vulnerability CVE-2026-13503 antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option