CVE-2025-23410

CRITICAL

GMOD Apollo < 2.8.0 - Path Traversal via Archive Upload

Title source: llm
STIX 2.1

Description

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07

Scores

CVSS v3 9.8
EPSS 0.0061
EPSS Percentile 44.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-23
Status published
Products (1)
GMOD/Apollo < 2.8.0
Published Mar 05, 2025
Tracked Since Feb 18, 2026