CVE-2025-22205

CVE-2025-22205 involves multiple path traversal vulnerabilities stemming from improper handling of input variables in the Admiror Gallery extension for Joomla, affecting the 4.x version branch. Classified under CWE-22 and CWE-35, the issue enables attackers to navigate outside intended directories. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high severity due to significant confidentiality risks.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation allows disclosure of arbitrary files on the affected server, potentially exposing sensitive data such as configuration files or user information, while integrity and availability remain unaffected.

Mitigation details are available in the vendor reference at http://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-gallery, published on 2025-02-04. Security practitioners should review this for patching instructions or workarounds specific to the Admiror Gallery extension.