CVE-2025-11034CWE-22path-traversal

CVE-2025-11034

Medium · published September 26, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

A vulnerability was found in Dibo Data Decision Making System up to 2.7.0. The affected element is the function downloadImpTemplet of the file /common/dep/common_dep.action.jsp. The manipulation of the argument filePath results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-26T22:15Z
References (4)
https://github.com/FightingLzn9/vul/blob/main/%E8%BF%AA%E5%8D%9A%E6%95%B0%E6%8D%AE%E5%86%B3%E7%AD%96%E7%B3%BB%E7%BB%9F.md · [email protected]https://vuldb.com/?ctiid.325981 · [email protected]https://vuldb.com/?id.325981 · [email protected]https://vuldb.com/?submit.658242 · [email protected]
EPSS history
Timeline
  • 26 SEP 18:02Z
    Dibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversal
    cvelistv5