CVE-2019-25582CWE-434

i-doit CMDB 1.12 Arbitrary File Download via file_manager Parameter

High · published March 21, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php. Attackers can send GET requests to index.php with file_manager=image and supply arbitrary file paths like src/config.inc.php to retrieve configuration files and sensitive system data.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00375 · 30.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-21T15:30Z
EPSS history
Timeline
  • 21 MAR 15:30Z
    i-doit CMDB 1.12 Arbitrary File Download via file_manager Parameter
    cvelistv5