CVE-2025-66955

Published: Mar 12, 2026Modified: Jul 5, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.

Affected (1)

Products: Asseco: Live

Asseco

1 product

Live

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Asseco Live	Version 2.0

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (2)

https://github.com/TheWoodenBench/CVE-2025-66955

Source: cve@mitre.org

Third Party Advisory

https://live.asee.io/

Source: cve@mitre.org

Product

Timeline

No history available yet.