PT-2025-47110 · Chunghwa Telecom · Tenderdoctransfer

Published 2025-11-17 · Updated 2025-12-19 · CVE-2025-13282

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TenderDocTransfer (affected versions not specified)

Description TenderDocTransfer, developed by Chunghwa Telecom, has an issue that allows for arbitrary file deletion. The application establishes a local web server and offers APIs for communication. A lack of CSRF protection in these APIs enables unauthenticated remote attackers to execute actions through phishing. One of the APIs also contains an Absolute Path Traversal flaw, potentially allowing attackers to delete arbitrary files on the user’s system. The API endpoints are vulnerable to exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

CWE-36

Related Identifiers

CVE-2025-13282

Affected Products

Tenderdoctransfer

References · 11

• https://osv.dev/vulnerability/CVE-2025-13282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13282 · Security Note
• https://t.me/cveNotify/142968 · Telegram Post
• https://twitter.com/cracbot/status/1991823965040607679 · Twitter Post
• https://twitter.com/cracbot/status/1992186338117136792 · Twitter Post
• https://twcert.org.tw/en/cp-139-10511-10f3a-2.html · Note
• https://twcert.org.tw/tw/cp-132-10510-3719c-1.html · Note
• https://t.me/cveNotify/146353 · Telegram Post
• https://t.me/CVEtracker/37465 · Telegram Post
• https://twitter.com/CVEnew/status/1990265515390935502 · Twitter Post
• https://twitter.com/SecAideInfo/status/1991088311201624321 · Twitter Post