CVE-2025-15187

GreenCMS File DataController.class.php path traversal

CVSS 5.1 MEDIUMEPSS 0.6%CWE-22

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

29 dic 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

n/a · GreenCMS

Referencias

https://github.com/ueh1013/VULN/issues/4 https://github.com/ueh1013/VULN/issues/5 https://vuldb.com/?ctiid.338572 https://vuldb.com/?id.338572 https://vuldb.com/?submit.721387 https://vuldb.com/?submit.724836 https://vuldb.com/?submit.725143