CVE-2025-41035

MEDIUM

appRain CMF 4.0.5 - Authenticated Path Traversal via Download Endpoint

Title source: llm
STIX 2.1

Description

A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0061
EPSS Percentile 44.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
apprain/apprain 4.0.5
Published Sep 04, 2025
Tracked Since Feb 18, 2026