CVE-2025-11941CWE-22path-traversal

CVE-2025-11941

Medium · published October 19, 2025

CVSS v3.1
5.4
EPSS
1%
Percentile
60.1
In the wild
Unconfirmed
What it is

A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00926 · 60.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-19T20:15Z
Affected products (1)
ProductVersionsFixed in
e107/e107≤ 2.3.3—
References (5)
https://note-hxlab.wetolink.com/share/igdVbDCk2IkD · [email protected]https://note-hxlab.wetolink.com/share/igdVbDCk2IkD#proof-of-concept- · [email protected]https://vuldb.com/?ctiid.329020 · [email protected]https://vuldb.com/?id.329020 · [email protected]https://vuldb.com/?submit.671867 · [email protected]
EPSS history
Timeline
  • 19 OCT 15:32Z
    e107 CMS Avatar image.php path traversal
    cvelistv5