PT-2025-48096 · Unknown · Gorilla Tag

Published 2025-11-25 · Updated 2025-11-26 · CVE-2025-65952

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gorilla Tag versions prior to 2.8.0

Description A path traversal issue exists in Console, a network used to control Gorilla Tag mods and users. Prior to version 2.8.0, specific combinations of backslashes and periods can be used to bypass the Gorilla Tag path and write to unintended directories.

Recommendations Update to version 2.8.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-65952

GHSA-C3F7-XH45-2XC7

Affected Products

Gorilla Tag

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65952.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65952 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65952 · Vendor Advisory
• https://github.com/iiDk-the-actual/Console/commit/4bcb1cf23ef78f8e6899dd6fe3afa3b24902e458 · Note
• https://github.com/iiDk-the-actual/Console/security/advisories/GHSA-c3f7-xh45-2xc7 · Note
• https://github.com/iiDk-the-actual/Console/commit/e1005b8754594ad463ae58f8a99decda548b1826 · Note
• https://twitter.com/CVEnew/status/1993458558781079634 · Twitter Post
• https://t.me/CVEtracker/38239 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993586204739072367 · Twitter Post
• https://t.me/cveNotify/144032 · Telegram Post