PT-2026-24025 · Wwwubr · Wwwubr

Adrien Rey + 1 · Published 2026-03-09 · Updated 2026-03-09 · CVE-2025-41755

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wwwubr versions (affected versions not specified)

Description A remote attacker with limited privileges can exploit the ubr-logread method in the ''wwwubr.cgi'' endpoint to read arbitrary files on the system. The endpoint accepts a parameter that specifies the log file to open, such as /tmp/weblog{some number}, but this parameter lacks proper validation. This allows an attacker to modify the parameter to reference any file and retrieve its contents. The vulnerable parameter is some number.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-41755

Affected Products

Wwwubr

References · 7

• https://osv.dev/vulnerability/CVE-2025-41755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41755 · Security Note
• https://mbs-solutions.de/mbs-2025-0001 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031122575955304739 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031008171599245538 · Twitter Post
• https://t.me/cveNotify/154754 · Telegram Post
• https://twitter.com/CVEarity/status/2031005954389741674 · Twitter Post