CVE-2025-67004

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-67004

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67004.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-67004

Published

2026-01-09T17:15:53.030Z

Modified

2026-03-13T03:41:58.450038Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly. NOTE: A community member states that this is not a CouchCMS vulnerability and that if /<file> is accessible it is a web-server configuration issue.

References

Affected packages

Git / github.com/couchcms/couchcms

Affected ranges

Type

GIT

Repo

https://github.com/couchcms/couchcms

Events

Introduced

Last affected

cfa2502b1a0e9c911fe2bc501cafd9ad8590c7ed

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4"
        }
    ]
}

Affected versions

v1.*

v1.3.5

v1.4

v1.4.5

v1.4.5RC1

v1.4.5RC2

v1.4.7

v2.*

v2.0

v2.1

v2.2

v2.2.1

v2.3

v2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67004.json"