CVE-2025-27413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27413
Aliases
  • GHSA-r3vj-47cf-4672
Published
2025-02-28T21:02:35.656Z
Modified
2026-04-02T12:46:06.619263Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json
Details

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (../) sequences. This is problematic for the template update functionality as it uses the path from the database to write arbitrary content to, potentially overwriting source code to achieve Remote Code Execution. Any user with the backups:create, backups:update and templates:update permissions (only administrators by default) can write arbitrary content to anywhere on the filesystem. By overwriting source code, it is possible to achieve Remote Code Execution. Version 1.2.0 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27413.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/pwndoc/pwndoc

Affected ranges

Type
GIT
Repo
https://github.com/pwndoc/pwndoc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
541e817979b718257b7590b370a23c00519cf71e

Affected versions

v0.*
v0.1.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.9.0
v1.*
v1.0.0
v1.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27413.json"