CVE-2025-11018CWE-22path-traversal

CVE-2025-11018

Medium · published September 26, 2025

CVSS v3.1

5.3

EPSS

Percentile

61.5

In the wild

Unconfirmed

What it is

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00971 · 61.5th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2025-09-26T18:15Z

Affected products (1)

Product	Versions	Fixed in
four-faith/water_conservancy_informatization	all versions	—

References (4)

https://github.com/MMarch7/CVE/issues/1 · [email protected]https://vuldb.com/?ctiid.325961 · [email protected]https://vuldb.com/?id.325961 · [email protected]https://vuldb.com/?submit.650695 · [email protected]

EPSS history

Timeline

26 SEP 14:02Z
Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal
cvelistv5