CVE-2025-7575CWE-22

Zavy86 WikiDocs submit.php image_delete_ajax path traversal

Medium · published July 14, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00469 · 39.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-07-14T05:14Z
EPSS history
Timeline
  • 14 JUL 05:14Z
    Zavy86 WikiDocs submit.php image_delete_ajax path traversal
    cvelistv5