PT-2026-26674 · Dreamfactory · Dreamfactory/Df-Core

Published 2026-03-20 · Updated 2026-03-22 · CVE-2025-55988

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DreamFactory Core version 1.0.3

Description An issue exists in the /Controllers/RestController.php component that allows attackers to execute a directory traversal due to an unsanitized URI path. The vulnerable component processes requests without proper validation of the provided path, potentially allowing unauthorized access to files and directories. The API endpoint involved is likely related to resource access through the REST controller. The vulnerable parameter is the URI path used in requests to this endpoint.

Recommendations Update DreamFactory Core to a version that addresses this issue. As a temporary workaround, restrict access to the /Controllers/RestController.php component to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-55988

GHSA-GV7F-W92J-383Q

Affected Products

Dreamfactory/Df-Core

References · 7

• https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756a5a22f6f56828950#diff-e57a7c0af25166ac8f02695307c6c413ca4ba0a48a20b2202ad910654528aab1 · Patch
• https://osv.dev/vulnerability/GHSA-gv7f-w92j-383q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55988 · Security Note
• https://github.com/dreamfactorysoftware/df-core · Note
• https://pentest-tools.com/PTT-2025-001-RemoteCodeExecution-via-URL-Path-Traversal.pdf · Note
• https://twitter.com/CVEnew/status/2035627029291274262 · Twitter Post