CVE-2025-25478

Published: Feb 28, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.

Affected (1)

Products: Syspass: Syspass

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Syspass Syspass	From 3.2.0 to 3.2.11

Related CWEs

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (2)

https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.