PT-2026-5187 · Unknown · 66Biolinks

Published 2026-01-28 · Updated 2026-02-09 · CVE-2025-69601

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions 66biolinks version 44.0.0

Description A directory traversal issue exists in the “Static Sites” feature. Uploaded ZIP archives are automatically extracted without validating or sanitizing file paths. An attacker can include traversal sequences (e.g., ../) in ZIP entries to write files outside the intended extraction directory. This allows static files (html, js, css, images) file write to unintended locations, or overwriting existing HTML files, potentially leading to content defacement and, in certain deployments, further impact if sensitive files are overwritten. A directory traversal sequence is a method used to access files and directories outside of the intended root directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-69601

Affected Products

66Biolinks

References · 5

• 🔥 https://gist.github.com/Waqar-Arain/9cd59aa74de540eeb3b09d15bac35e36 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69601 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69601 · Vendor Advisory
• https://twitter.com/CVEnew/status/2016587745859170701 · Twitter Post
• https://t.me/cveNotify/151447 · Telegram Post