PT-2025-38227 · Unknown · Swetrix Web Analytics Api

Depthfirstdisclosures · Published 2025-09-17 · Updated 2025-11-09 · CVE-2025-59304

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Swetrix Web Analytics API versions prior to 7d8b972

Description A directory traversal issue exists in Swetrix Web Analytics API 3.1.1 before commit 7d8b972. This allows a remote attacker to achieve Remote Code Execution via a crafted HTTP request.

Recommendations Update Swetrix Web Analytics API to version 7d8b972 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-59304

Affected Products

Swetrix Web Analytics Api

References · 8

• 🔥 https://depthfirst.com/post/anatomy-of-an-automated-patch-fixing-a-file-upload-rce-cve-2025-59304 · Exploit
• https://github.com/Swetrix/swetrix/pull/397 · Patch
• https://osv.dev/vulnerability/CVE-2025-59304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59304 · Security Note
• https://reddit.com/r/CVEWatch/comments/1ormqhk/top_10_trending_cves_08112025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1osgn6m/top_10_trending_cves_09112025 · Reddit Post
• https://twitter.com/CVEnew/status/1969110934640799930 · Twitter Post
• https://t.me/cveNotify/137870 · Telegram Post