PT-2025-49810 · Jmri · Jmri

Titan Team · Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-14311

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions JMRI versions prior to 5.13.3

Description A flaw exists in JMRI related to improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' issue. This could allow unauthorized access to files or directories. There is no information about the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability involves manipulating file paths to access resources outside the intended directory.

Recommendations Update JMRI to version 5.13.3 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14311

Affected Products

Jmri

References · 5

• https://github.com/JMRI/JMRI/pull/14340 · Patch
• https://osv.dev/vulnerability/CVE-2025-14311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14311 · Security Note
• https://t.me/CVEtracker/39231 · Telegram Post
• https://twitter.com/CVEnew/status/1998355355852759066 · Twitter Post