CVE-2025-4377

HIGH

Sparx Systems Pro Cloud Server <6.0.165 - Path Traversal

Title source: llm

Description

Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165.

References (1)

Core 1

Core References

Various Sources

https://sparxsystems.com/products/procloudserver/6.1/

Scores

CVSS v4 8.3

EPSS 0.0062

EPSS Percentile 45.0%

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-20 CWE-22

Status published

Products (2)

Sparx Systems/Pro Cloud Server < 6.0.163

Sparx Systems/Pro Cloud Server 6.0.165

Published May 09, 2025

Tracked Since Feb 18, 2026