CVE-2025-12923CWE-22path-traversal

CVE-2025-12923

Low · published November 10, 2025

CVSS v3.1
2.7
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00622 · 49.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-11-10T06:15Z
Affected products (1)
ProductVersionsFixed in
1000mz/chestnutcms≤ 1.5.8—
References (4)
https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md · [email protected]https://vuldb.com/?ctiid.331643 · [email protected]https://vuldb.com/?id.331643 · [email protected]https://vuldb.com/?submit.681032 · [email protected]
EPSS history
Timeline
  • 10 NOV 00:32Z
    liweiyi ChestnutCMS download resourceDownload path traversal
    cvelistv5