CVE-2025-69618 Details
Description
An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.
An arbitrary file overwrite vulnerability has been identified in the Coto Tarot, Astro & Healing app, specifically in version 11.4.0. This vulnerability allows attackers to overwrite critical internal files through the file import process. The issue arises from inadequate security validation when handling imported files, enabling a malicious app to manipulate filenames and contents using path traversal to overwrite sensitive files in the app's internal storage. Such modifications to essential configuration or executable files could disrupt the app's functionality, cause it to fail to launch, or facilitate arbitrary code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://coto.world/ | [email protected] | Product |
| https://github.com/Secsys-FDU/AF_CVEs/issues/9 | [email protected] | ExploitThird Party Advisory |
| https://secsys.fudan.edu.cn/ | [email protected] | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| coto.world coto | 11.4.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | CVE Modified | CISA-ADP |
| Feb 11, 2026 | Initial Analysis | [email protected] |
| Feb 11, 2026 | CVE Modified | CISA-ADP |
| Feb 4, 2026 | New CVE Received | [email protected] |