PT-2025-45585 · Liweiyi · Chestnutcms

Huu1J · Publicado 2025-11-10 · Atualizado 2025-11-21 · CVE-2025-12923

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions liweiyi ChestnutCMS versions up to 1.5.8

Description A flaw exists in the resourceDownload function located in the /dev-api/common/download file. Manipulation of the path argument can result in path traversal, allowing for remote exploitation. The exploit for this issue has been made public.

Recommendations versions prior to 1.5.9

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-12923

Produtos afetados

Chestnutcms

Referências · 11

• 🔥 https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12923 · Nota de Segurança
• https://vuldb.com/?id.331643 · Nota
• https://osv.dev/vulnerability/CVE-2025-12923 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1987689532615999933 · Publicação no Twitter
• https://vuldb.com/?submit.681032 · Nota
• https://t.me/CVEtracker/36880 · Publicação no Telegram
• https://t.me/cveNotify/143590 · Publicação no Telegram
• https://vuldb.com/?ctiid.331643 · Nota
• https://t.me/cveNotify/142228 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1987694420443963473 · Publicação no Twitter