CVE-2025-25997
Published: 14 February 2025
Description
Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component.
Security Summary
CVE-2025-25997 is a Directory Traversal vulnerability (CWE-22) in FeMiner wms version 1.0. The flaw exists in the databak.php component, which allows a remote attacker to obtain sensitive information by traversing directories outside the intended path.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and unchanged scope. A remote, unauthenticated attacker can leverage this to disclose sensitive information, resulting in high confidentiality impact while leaving integrity and availability unaffected.
Mitigation details are available in the referenced GitHub issue at https://github.com/FeMiner/wms/issues/22.
Details
- CWE(s)