CVE-2025-60915
Published: 24 November 2025
Description
An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses path traversal by requiring validation of the size query parameter in /views/file.py to detect and block malicious directory traversal inputs.
Mandates timely remediation of the specific flaw in Openatlas versions before v8.12.0 by patching or upgrading to the fixed version.
Boundary protection at web interfaces can filter crafted HTTP requests containing path traversal sequences before they reach the vulnerable endpoint.
Security SummaryAI
CVE-2025-60915 is a path traversal vulnerability (CWE-22) affecting the size query parameter in the /views/file.py endpoint of the Austrian Archaeological Institute's Openatlas software in versions before v8.12.0. Published on 2025-11-24, it enables attackers to traverse directory paths through a crafted HTTP request, earning a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this remotely over the network with low complexity and no user interaction required. Exploitation allows high confidentiality and integrity impacts, potentially enabling unauthorized access to sensitive files, including local file inclusion for exfiltrating configuration data.
Advisories recommend upgrading to Openatlas v8.12.0 or later to mitigate the issue. Further details on the vulnerability, including proof-of-concept exploitation, are documented at https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-lfi-konfigurationsdatei-exfiltration/ and https://www.sec4you-pentest.com/schwachstellen/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in public-facing web application endpoint (/views/file.py) enables remote exploitation by low-privileged authenticated users to access and exfiltrate sensitive local files including configuration data, directly mapping to Exploit Public-Facing Application (T1190).