CVE-2025-10232CWE-22path-traversal

CVE-2025-10232

Medium · published September 11, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileManagerAPIController.php. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-11T03:15Z
References (4)
https://github.com/August829/Yu/blob/main/58ead8e7e08bfb010.md · [email protected]https://vuldb.com/?ctiid.323501 · [email protected]https://vuldb.com/?id.323501 · [email protected]https://vuldb.com/?submit.641567 · [email protected]
EPSS history
Timeline
  • 10 SEP 22:32Z
    299ko FileManagerAPIController.php delete path traversal
    cvelistv5