CVE-2025-13771CWE-23

CVE-2025-13771

Medium · published November 28, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2025-11-28T13:15Z
Affected products (1)
ProductVersionsFixed in
uniong/webitr< 2_1_0_342_1_0_34
References (2)
https://www.twcert.org.tw/en/cp-139-10539-21f45-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-10538-6a26d-1.html · [email protected]
EPSS history
Timeline
  • 28 NOV 07:49Z
    Uniong｜WebITR - Arbitrary File Read
    cvelistv5