CVE-2025-2032 MEDIUM

CVE-2025-2032: ChestnutCMS rename renameFile path traversal

Vendor N/A

Product ChestnutCMS

Weakness CWE-22 · Path traversal

Published March 6, 2025

Last update March 12, 2025

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 6, 2025 CVE published

March 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-2032 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2023-24815 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web CVE-2025-46486 WordPress Nomupay Payment Processing Gateway plugin <= 7.1.7 - Arbitrary File Download Vulnerability CVE-2026-28462 OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths CVE-2023-5245 Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution. CVE-2026-20174 Cisco Nexus Dashboard Insights Arbitrary File Write Vulnerability