CVE-2024-13671CWE-22

Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read

High · published January 30, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-25155 is likely a duplicate of this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00540 · 44.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-01-30T13:41Z
EPSS history
Timeline
  • 30 JAN 13:41Z
    Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read
    cvelistv5