CVE-2025-25478 Details
Description
The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.
A vulnerability exists in Syspass versions 3.2.x within the account file upload feature, where special characters in filenames are not properly managed. This oversight allows for the unintentional disclosure of the web application's source code, revealing sensitive information such as the database password.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| syspass syspass | >= 3.2.0, <= 3.2.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2025 | Initial Analysis | [email protected] |
| Mar 5, 2025 | CVE Modified | CISA-ADP |
| Feb 28, 2025 | New CVE Received | [email protected] |