PT-2025-14740 · Vlad.Olaru · Fonto

Minhtuanact · Published 2025-04-03 · Updated 2025-04-03 · CVE-2025-31827

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fonto versions 1.2.2 and earlier

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability allows for Path Traversal in the vlad.olaru Fonto software.

Recommendations For Fonto versions 1.2.2 and earlier, consider restricting access to sensitive directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider implementing additional validation and sanitization for user-inputted pathnames to prevent unauthorized access to restricted directories.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-31827

Affected Products

Fonto

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-31827 · Security Note
• https://t.me/cvetracker/20682 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/fonto/vulnerability/wordpress-fonto-plugin-1-2-2-arbitrary-file-download-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1907913686393696404 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/fonto/vulnerability/wordpress-fonto-plugin-1-2-2-arbitrary-file-download-vulnerability?_s_id=cve · Note