CVE-2025-27410mediumCWE-22CWE-23

CVE-2025-27410: falha de média gravidade em pwndoc

PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pwndoc

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 2.1%
PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
pwndoc · pwndoc
CVEs relacionadas — pwndoc

No mesmo produto, das mais perigosas para as menos.

CVE-2025-27413MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.jsonEPSS 1.2%CVE-2024-55602HIGHPenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path TraversalEPSS 0.7%CVE-2024-55652MEDIUMPwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filtersEPSS 0.7%CVE-2024-55653MEDIUMpwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)EPSS 0.6%CVE-2025-23044MEDIUMCross-Site Request Forgery (CSRF) allows creating admin account with POST requestEPSS 0.3%