CVE-2025-12923

A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.7 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
VulDBCNA
2.7 LOW
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
1000mzchestnutcms
𝑥
≤ 1.5.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md
https://vuldb.com/?ctiid.331643
https://vuldb.com/?id.331643
https://vuldb.com/?submit.681032