CVE-2025-2305

HIGH

SYNCPILOT LIVE CONTRACT 3-5.4.11, 5.5-5.5.3, 5.6-5.6.2 - Unauthenticated Path Traversal via File Download Functionality

Title source: llm

Description

A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server.

References (1)

Core 1

Core References

Various Sources

https://www.cirosec.de/sa/sa-2025-003

Scores

CVSS v3 8.6

EPSS 0.0033

EPSS Percentile 24.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (3)

SYNCPILOT/LIVE CONTRACT 3 - 5.4.12

SYNCPILOT/LIVE CONTRACT 5.5 - 5.5.4

SYNCPILOT/LIVE CONTRACT 5.6 - 5.6.3

Published May 16, 2025

Tracked Since Feb 18, 2026