CVE-2025-27410mediumCWE-22CWE-23

CVE-2025-27410: medium-severity vulnerability in pwndoc

PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

Published · Updated

Follow this CVE+ Monitor pwndoc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 2.1%
PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
pwndoc · pwndoc
Related CVEs — pwndoc

In the same product, most dangerous first.

CVE-2025-27413MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.jsonEPSS 1.2%CVE-2024-55602HIGHPenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path TraversalEPSS 0.7%CVE-2024-55652MEDIUMPwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filtersEPSS 0.7%CVE-2024-55653MEDIUMpwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)EPSS 0.6%CVE-2025-23044MEDIUMCross-Site Request Forgery (CSRF) allows creating admin account with POST requestEPSS 0.3%