CVE-2025-27410

EIP tracks 1 public exploit for CVE-2025-27410. PoCs published by shreyas-malhotra.

AI-analyzed exploit summary This PoC exploits a directory traversal vulnerability in PwnDoc's backup restore functionality (CVE-2025-27410) to achieve arbitrary file write and remote code execution. It crafts a malicious tar archive to overwrite a JavaScript module, injecting arbitrary code execution via child_process.execSync.

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.