CVE-2025-49008criticalCWE-78CWE-88

CVE-2025-49008: falha crítica em Atheos

Atheos Improper Input Validation Vulnerability Enables RCE in Common.php

Publicada em

Seguir esta CVE+ Monitorar Atheos

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.6%
Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe_execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Atheos · Atheos
CVEs relacionadas — Atheos

No mesmo produto, das mais perigosas para as menos.

CVE-2025-22152CRITICALImproper Path Validation Enables Path Traversal in Multiple Components in AtheosEPSS 0.6%CVE-2025-47788CRITICALMissing Path Validation Enables Path Traversal in Controller.phpEPSS 0.5%