PT-2025-9140 · Syspass · Syspass

Published 2025-02-28 · Updated 2025-07-09 · CVE-2025-25478

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Syspass versions 3.2.x

Description The account file upload functionality in Syspass fails to properly handle special characters in filenames, leading to the disclosure of the web application's source code and exposing sensitive information such as the database password.

Recommendations For Syspass versions 3.2.x, consider disabling the file upload functionality until a patch is available to prevent the disclosure of sensitive information. As a temporary workaround, restrict access to the file upload feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-25478

Affected Products

Syspass

References · 9

• 🔥 https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478 · Exploit
• https://osv.dev/vulnerability/CVE-2025-25478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25478 · Security Note
• https://twitter.com/VulmonFeeds/status/1895638949030212056 · Twitter Post
• https://t.me/cvenotify/112932 · Telegram Post
• https://twitter.com/CVEnew/status/1895619362931032126 · Twitter Post
• https://twitter.com/cybercronai/status/1896214451310715090 · Twitter Post
• https://t.me/cvedetector/19195 · Telegram Post
• https://t.me/cvenotify/128279 · Telegram Post