CVE-2025-9639

HIGH

Ai3 QbiCRMGateway 7.5.1-8.5.02 - Unauthenticated Arbitrary File Read via Relative Path Traversal

Title source: llm
STIX 2.1

Description

The QbiCRMGateway developed by Ai3 has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10364-6ac24-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-10365-bf667-2.html

Scores

CVSS v3 7.5
EPSS 0.0054
EPSS Percentile 40.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-23
Status published
Products (1)
Ai3/QbiCRMGateway 7.5.1 - 8.5.03
Published Aug 29, 2025
Tracked Since Feb 18, 2026