PT-2026-4109 · Aivahthemes · Hostme V2

Published 2026-01-22 · Updated 2026-01-23 · CVE-2025-68907

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AivahThemes Hostme v2 versions through 7.0

Description A Path Traversal issue exists in AivahThemes Hostme v2. The issue allows an attacker to traverse directory restrictions via improper pathname limitation. The API endpoint is not mentioned. The vulnerable parameter or variable is not mentioned. The vulnerable function is not mentioned.

Recommendations Versions prior to 7.0 should be updated.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-68907

Affected Products

Hostme V2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-68907 · Security Note
• https://patchstack.com/database/Wordpress/Theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-arbitrary-file-deletion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2014706976320606554 · Twitter Post