CVE-2025-27410mediumCWE-22CWE-23

CVE-2025-27410: fallo de gravedad media en pwndoc

PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pwndoc

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 2.1%
PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Productos afectados
pwndoc · pwndoc
CVEs relacionadas — pwndoc

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-27413MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.jsonEPSS 1.2%CVE-2024-55602HIGHPenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path TraversalEPSS 0.7%CVE-2024-55652MEDIUMPwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filtersEPSS 0.7%CVE-2024-55653MEDIUMpwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)EPSS 0.6%CVE-2025-23044MEDIUMCross-Site Request Forgery (CSRF) allows creating admin account with POST requestEPSS 0.3%