CVE-2025-62356 HIGH

CVE-2025-62356

Vendor Qodo
Product Qodo Gen
Weakness CWE-22 · Path traversal
Published October 17, 2025
Last update October 17, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indirect prompt injection.

Key dates

02Disclosure timeline

October 17, 2025 CVE published
October 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-42970 Directory Traversal vulnerability in SAPCAR CVE-2026-46484 Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user CVE-2024-53961 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CVE-2026-5203 CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal CVE-2025-10766 SeriaWei ZKEACMS EventViewerController.cs Download path traversal