CVE-2025-9257 HIGH

CVE-2025-9257: Uniong｜WebITR - Arbitrary File Reading through Path Traversal

Vendor Uniong

Product WebITR

Weakness CWE-36

Published August 22, 2025

Last update August 22, 2025

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.

Key dates

02Disclosure timeline

August 22, 2025 CVE published

August 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-9257 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/36.html

Related vulnerabilities

04Related CVE

CVE-2023-4172 Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversal CVE-2023-32054 Volume Shadow Copy Elevation of Privilege Vulnerability CVE-2024-29053 Microsoft Defender for IoT Remote Code Execution Vulnerability CVE-2021-1618 Cisco Intersight Virtual Appliance Vulnerabilities CVE-2026-1018 Gotac｜Police Statistics Database System - Arbitrary File Read