VulnerabilityDeferred

CVE-2025-2305

A Path traversal vulnerability in the file download functionality was identified.

HIGH 8.6EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server.

CVSS 3.1: 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.38% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-20
Source: a341c0d1-ebf7-493f-a84e-38cf86618674

References

https://www.cirosec.de/sa/sa-2025-003

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.