CVE-2025-2305CWE-20

Local file inclusion vulnerability in LIVE CONTRACT

High · published May 16, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

A Path traversal vulnerability in the file

download functionality was identified. This vulnerability allows

unauthenticated users to download arbitrary files, in the context of the

application server, from the Linux server.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-05-16T12:09Z
EPSS history
Timeline
  • 16 MAY 12:09Z
    Local file inclusion vulnerability in LIVE CONTRACT
    cvelistv5