CVE-2025-60217CWE-22path-traversal

CVE-2025-60217

High · published October 22, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

⚡ A sneaky path traversal vulnerability in PT Luxa Addons could let attackers access files outside the designated directory! 🔥 Think of it like a delivery driver who can take any route to reach their destination, even if it means trespassing into restricted areas. Instead of just delivering packages, they might start rummaging through your sensitive files! An attacker could exploit this vulnerability to gain unauthorized access to sensitive files on your server. This means they could read, modify, or even delete crucial data, potentially leading to a devastating breach of privacy and data integrity.

Put simply

Think of it like a delivery driver who can take any route to reach their destination, even if it means trespassing into restricted areas. Instead of just delivering packages, they might start rummaging through your sensitive files! This path traversal vulnerability allows attackers to manipulate file paths in a way that circumvents the application's restrictions, enabling access to files outside the intended directory. The flaw exists in PT Luxa Addons versions up to and including 1.2.2.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to sensitive files on your server. This means they could read, modify, or even delete crucial data, potentially leading to a devastating breach of privacy and data integrity. Update PT Luxa Addons to the latest version immediately. Review the file path handling to ensure proper validations are in place and restrict file access effectively. Regularly audit your server for any potential exposures to mitigate risks further. You've got this! By taking these steps, you'll keep your server safe and secure. 🛡️

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Deletion Vulnerability
    cvelistv5