PT-2025-11985 · Applio · Applio

Sylwia Budzynska + 1 · Publicado 2025-03-19 · Atualizado 2025-03-20 · CVE-2025-27785

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior

Description The issue is related to arbitrary file read in the export index function of train.py. This may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to.

Recommendations For versions 3.2.8-bugfix and prior, as a temporary workaround, consider disabling the export index function in train.py until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Path traversal

Enumeração de Fraquezas

CWE-200

CWE-22

Identificadores relacionados

CVE-2025-27785

Produtos afetados

Applio

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27785.json · Exploit
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L273 · Nota
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L816 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-27785 · Nota de Segurança
• https://t.me/cvetracker/19490 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1902462706185302160 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-27785 · Aviso do Fabricante
• https://t.me/cvedetector/20675 · Publicação no Telegram
• https://twitter.com/CVETracker/status/1902812578125959389 · Publicação no Twitter
• https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/2004 · Publicação no Telegram