PT-2026-4528 · Gemscms · Gemscms

Published 2026-01-23 · Updated 2026-02-11 · CVE-2025-52023

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gemscms versions prior to 2025-05-28

Description A flaw exists in the PHP backend of gemscms that permits unauthenticated remote attackers to initiate detailed error messages. These messages reveal internal file paths, code segments, and stack traces. The issue arises from specifically designed HTTP GET/POST requests directed at public API endpoints, potentially exposing sensitive data that could aid in further attacks. This is categorized as an information exposure issue due to error messages.

Recommendations Update gemscms to a version later than 2025-05-28.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2025-52023

Affected Products

Gemscms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-52023 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52023 · Vendor Advisory
• https://t.me/CVEtracker/42882 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014834942283280658 · Twitter Post
• https://twitter.com/CVEnew/status/2015362487890460912 · Twitter Post
• https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39 · Note
• http://gemscms.com · Note
• https://t.me/cveNotify/151746 · Telegram Post
• http://aptsys.com · Note