CVE-2025-54141CWE-22CWE-79

ViewVC's standalone server exposes arbitrary server filesystem content

High · published July 22, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00849 · 57.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-22T21:35Z
EPSS history
Timeline
  • 22 JUL 21:35Z
    ViewVC's standalone server exposes arbitrary server filesystem content
    cvelistv5