PT-2026-24025 · Wwwubr · Wwwubr

Adrien Rey + 1 · Publicado 2026-03-09 · Atualizado 2026-03-09 · CVE-2025-41755

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wwwubr versions (affected versions not specified)

Description A remote attacker with limited privileges can exploit the ubr-logread method in the ''wwwubr.cgi'' endpoint to read arbitrary files on the system. The endpoint accepts a parameter that specifies the log file to open, such as /tmp/weblog{some number}, but this parameter lacks proper validation. This allows an attacker to modify the parameter to reference any file and retrieve its contents. The vulnerable parameter is some number.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-41755

Produtos afetados

Wwwubr

Referências · 7

• https://osv.dev/vulnerability/CVE-2025-41755 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031122575955304739 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2031008171599245538 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-41755 · Nota de Segurança
• https://mbs-solutions.de/mbs-2025-0001 · Aviso do Fabricante
• https://t.me/cveNotify/154754 · Publicação no Telegram
• https://twitter.com/CVEarity/status/2031005954389741674 · Publicação no Twitter