CVE-2025-2917 MEDIUM

CVE-2025-2917: ChestnutCMS read readFile path traversal

Vendor N/A
Product ChestnutCMS
Weakness CWE-22 · Path traversal
Published March 28, 2025
Last update March 28, 2025

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 28, 2025 CVE published
March 28, 2025 Record updated

Related vulnerabilities

04Related CVE