PT-2025-7790 · Unknown · Dependency-Track

Jonathan Leitschuh · Published 2025-02-24 · Updated 2025-02-28 · CVE-2025-27137

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.12.6

Description The issue allows users with the SYSTEM CONFIGURATION permission to abuse the include tag in notification templates, potentially leaking sensitive local files, such as /etc/passwd or /proc/1/environ, by including them in notification templates and sending notifications to a controlled destination.

Recommendations For versions prior to 4.12.6, avoid assigning the SYSTEM CONFIGURATION permission to untrusted users, as this permission is a security risk if granted to non-administrative users or teams. Update to version 4.12.6 or later, where the include tag can no longer be used and its usage will cause template evaluation to fail.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-27137

GHSA-9582-88HR-54W3

GHSA-P75G-CXFJ-7WRX

Affected Products

Dependency-Track

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27137.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27137 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1686 · Security Note
• https://osv.dev/vulnerability/GHSA-p75g-cxfj-7wrx · Vendor Advisory
• https://github.com/DependencyTrack/dependency-track/pull/4685 · Note
• https://github.com/DependencyTrack/dependency-track/pull/4684 · Note
• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9582-88hr-54w3 · Note
• https://github.com/PebbleTemplates/pebble/pull/715 · Note
• https://github.com/PebbleTemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329 · Note
• https://github.com/PebbleTemplates/pebble/issues/680 · Note
• https://github.com/PebbleTemplates/pebble/issues/688 · Note
• https://github.com/PebbleTemplates/pebble · Note
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-p75g-cxfj-7wrx · Note
• https://twitter.com/CVEnew/status/1894133570815279415 · Twitter Post