CVE-2025-1106

MEDIUM

CmsEasy 7.7.7.9 - Path Traversal in database_admin.php deletedir_action/restore_action

Title source: llm
STIX 2.1

Description

A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.294939
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.294939
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.491518

Scores

CVSS v3 5.4
EPSS 0.0090
EPSS Percentile 55.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
cmseasy/cmseasy 7.7.7.9
Published Feb 07, 2025
Tracked Since Feb 18, 2026