PT-2025-40315 · Unknown · Gtone Changeflow

Published 2025-10-02 · Updated 2025-10-02 · CVE-2025-11221

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GTONE ChangeFlow versions through 9.0.1.1

Description The software contains issues related to improper limitation of a pathname to a restricted directory (Path Traversal) and unrestricted upload of files with dangerous types. These issues can lead to path traversal and unauthorized access to functionality not properly constrained by Access Control Lists (ACLs). The combination of these issues creates a significant security risk.

Recommendations Versions prior to 9.0.1.1 should be updated. Block external access to the application. Monitor file uploads closely. Verify and enforce proper ACL constraints.

Fix

RCE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2025-11221

Affected Products

Gtone Changeflow

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11221 · Security Note
• https://twitter.com/offseq/status/1973629698362999225 · Twitter Post
• https://twitter.com/CVEnew/status/1973626772194214359 · Twitter Post
• https://twitter.com/CveFindCom/status/1973624583656738822 · Twitter Post
• https://t.me/cveNotify/137142 · Telegram Post
• https://t.me/CVEtracker/33902 · Telegram Post
• https://twitter.com/0dayPublishing/status/1973619909704769847 · Twitter Post
• http://gtone.co.kr/kr/application-lifecycle-management.php · Note