CVE-2025-14698CWE-22path-traversal

CVE-2025-14698

Medium · published December 15, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

A weakness has been identified in atlaszz AI Photo Team Galleryit App 1.3.8.2 on Android. This affects an unknown part of the component gallery.photogallery.pictures.vault.album. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-15T08:15Z
References (4)
https://github.com/Secsys-FDU/AF_CVEs/issues/2 · [email protected]https://vuldb.com/?ctiid.336416 · [email protected]https://vuldb.com/?id.336416 · [email protected]https://vuldb.com/?submit.706213 · [email protected]
EPSS history
Timeline
  • 15 DEC 02:32Z
    atlaszz AI Photo Team Galleryit App gallery.photogallery.pictures.vault.album path traversal
    cvelistv5