CVE-2025-41035: high-severity vulnerability in appRain CMF
Path Traversal vulnerability in appRain CMF
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.7%
A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
appRain · appRain CMFRelated CVEs — appRain CMF
In the same product, most dangerous first.
CVE-2025-41034HIGHSQL injection vulnerability in appRain CMFEPSS 0.4%CVE-2025-41033HIGHSQL injection vulnerability in appRain CMFEPSS 0.4%CVE-2025-41032HIGHSQL injection vulnerability in appRain CMFEPSS 0.4%CVE-2025-41038MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-41037MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-41036MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%