PT-2025-51740 · Unknown · Allsky Webui

Dinhtwan + 1 · Published 2025-12-16 · Updated 2026-03-13 · CVE-2025-63414

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allsky WebUI version v2024.12.06 06

Description A path traversal flaw exists in Allsky WebUI version v2024.12.06 06 that permits an unauthenticated remote attacker to execute commands on the system. This is achieved by submitting a specially crafted HTTP request to the /html/execute.php API endpoint, utilizing a malicious payload within the id parameter. Successful exploitation results in arbitrary command execution, potentially leading to full remote code execution (RCE).

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /html/execute.php endpoint. Avoid using the id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

OS Command Injection

Weakness Enumeration

CWE-22

CWE-78

Related Identifiers

CVE-2025-63414

Affected Products

Allsky Webui

References · 9

• 🔥 https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414 · Exploit
• https://osv.dev/vulnerability/CVE-2025-63414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63414 · Security Note
• https://github.com/AllskyTeam/allsky · Note
• https://github.com/AllskyTeam/allsky/blob/master/html/execute.php · Note
• https://t.me/cveNotify/147248 · Telegram Post
• https://twitter.com/CveFindCom/status/2000984070910525474 · Twitter Post
• https://twitter.com/pulsepatchio/status/2032474310162751755 · Twitter Post
• https://twitter.com/CVEnew/status/2002857318455886034 · Twitter Post