PT-2025-9135 · Pwndoc · Pwndoc

Jorianwoltjer · Published 2025-02-28 · Updated 2025-04-15 · CVE-2025-27413

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PwnDoc versions prior to 1.2.0

Description The issue concerns the backup restore functionality, which allows an administrator to import raw data into the database, including Path Traversal (../) sequences. This is problematic for the template update functionality as it uses the path from the database to write arbitrary content to, potentially overwriting source code to achieve Remote Code Execution. Any user with the backups:create, backups:update, and templates:update permissions, which are limited to administrators by default, can write arbitrary content to anywhere on the filesystem. By overwriting source code, it is possible to achieve Remote Code Execution.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 to resolve the issue. As a temporary workaround, consider restricting the backups:create, backups:update, and templates:update permissions to limit the potential for exploitation. Additionally, restrict access to the template update functionality to minimize the risk of arbitrary content being written to the filesystem.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-27413

GHSA-R3VJ-47CF-4672

Affected Products

Pwndoc

References · 15

• 🔥 https://github.com/pwndoc/pwndoc/security/advisories/GHSA-r3vj-47cf-4672 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27413.json · Exploit
• https://github.com/pwndoc/pwndoc/commit/68aa1ea676a91e17bfb333a27571151bd07fb21d · Patch
• https://osv.dev/vulnerability/CVE-2025-27413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27413 · Security Note
• https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/models/template.js#L170-L175 · Note
• https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/template.js#L63-L66 · Note
• https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L826-L827 · Note
• https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0 · Note
• https://twitter.com/CVETracker/status/1895927205978411459 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895618460102631915 · Twitter Post
• https://t.me/cvedetector/19191 · Telegram Post
• https://twitter.com/CVEnew/status/1895619297109790739 · Twitter Post
• https://twitter.com/dailycve/status/1912261859987845561 · Twitter Post
• https://t.me/cvenotify/113453 · Telegram Post