What the vulnerability does
01Description
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.
CVSS base score
8.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Key dates
02Disclosure timeline
November 6, 2025
CVE published
November 7, 2025
Record updated
External resources
