CVE-2025-66905 Details
Description
The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system.
A directory traversal vulnerability has been identified in the Takes web framework, specifically in the TkFiles component of version 2.0-SNAPSHOT. The issue arises because the framework fails to properly canonicalize HTTP request paths before resolving them against the filesystem. This allows remote attackers to include '../' sequences in the request path to escape the designated base directory and access arbitrary files on the host system. The vulnerability contradicts the framework's documentation, which claims that directory traversal attempts are handled safely.
To address this vulnerability, it is recommended to update the TkFiles component to a version that includes proper path canonicalization and traversal validation. Additionally, implement regression tests to cover directory traversal scenarios.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66905_report.md | [email protected] | ExploitThird Party Advisory |
| https://github.com/yegor256/takes | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| takes tkfiles | 2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 6, 2026 | Initial Analysis | [email protected] |
| Dec 19, 2025 | New CVE Received | [email protected] |
| Dec 19, 2025 | CVE Modified | CISA-ADP |