Refine your search

2 vulnerabilities found for ChestnutCMS by liweiyi

CVE-2025-12923 (GCVE-0-2025-12923)
Vulnerability from nvd
Published
2025-11-10 00:32
Modified
2025-11-10 00:32
Severity ?
2.0 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R
2.7 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R
CWE
Summary
A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
References
Impacted products
Vendor Product Version
liweiyi ChestnutCMS Version: 1.5.0
Version: 1.5.1
Version: 1.5.2
Version: 1.5.3
Version: 1.5.4
Version: 1.5.5
Version: 1.5.6
Version: 1.5.7
Version: 1.5.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ChestnutCMS",
          "vendor": "liweiyi",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0"
            },
            {
              "status": "affected",
              "version": "1.5.1"
            },
            {
              "status": "affected",
              "version": "1.5.2"
            },
            {
              "status": "affected",
              "version": "1.5.3"
            },
            {
              "status": "affected",
              "version": "1.5.4"
            },
            {
              "status": "affected",
              "version": "1.5.5"
            },
            {
              "status": "affected",
              "version": "1.5.6"
            },
            {
              "status": "affected",
              "version": "1.5.7"
            },
            {
              "status": "affected",
              "version": "1.5.8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Huu1j (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized."
        },
        {
          "lang": "de",
          "value": "In liweiyi ChestnutCMS up to 1.5.8 ist eine Schwachstelle entdeckt worden. Es geht hierbei um die Funktion resourceDownload der Datei /dev-api/common/download. Die Manipulation des Arguments path f\u00fchrt zu path traversal. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T00:32:06.381Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-331643 | liweiyi ChestnutCMS download resourceDownload path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.331643"
        },
        {
          "name": "VDB-331643 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.331643"
        },
        {
          "name": "Submit #681032 | liweiyi ChestnutCMS 1.5.8 Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.681032"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-09T07:52:50.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "liweiyi ChestnutCMS download resourceDownload path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12923",
    "datePublished": "2025-11-10T00:32:06.381Z",
    "dateReserved": "2025-11-09T06:47:32.759Z",
    "dateUpdated": "2025-11-10T00:32:06.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12923 (GCVE-0-2025-12923)
Vulnerability from cvelistv5
Published
2025-11-10 00:32
Modified
2025-11-10 00:32
Severity ?
2.0 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R
2.7 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R
CWE
Summary
A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
References
Impacted products
Vendor Product Version
liweiyi ChestnutCMS Version: 1.5.0
Version: 1.5.1
Version: 1.5.2
Version: 1.5.3
Version: 1.5.4
Version: 1.5.5
Version: 1.5.6
Version: 1.5.7
Version: 1.5.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ChestnutCMS",
          "vendor": "liweiyi",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0"
            },
            {
              "status": "affected",
              "version": "1.5.1"
            },
            {
              "status": "affected",
              "version": "1.5.2"
            },
            {
              "status": "affected",
              "version": "1.5.3"
            },
            {
              "status": "affected",
              "version": "1.5.4"
            },
            {
              "status": "affected",
              "version": "1.5.5"
            },
            {
              "status": "affected",
              "version": "1.5.6"
            },
            {
              "status": "affected",
              "version": "1.5.7"
            },
            {
              "status": "affected",
              "version": "1.5.8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Huu1j (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized."
        },
        {
          "lang": "de",
          "value": "In liweiyi ChestnutCMS up to 1.5.8 ist eine Schwachstelle entdeckt worden. Es geht hierbei um die Funktion resourceDownload der Datei /dev-api/common/download. Die Manipulation des Arguments path f\u00fchrt zu path traversal. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T00:32:06.381Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-331643 | liweiyi ChestnutCMS download resourceDownload path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.331643"
        },
        {
          "name": "VDB-331643 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.331643"
        },
        {
          "name": "Submit #681032 | liweiyi ChestnutCMS 1.5.8 Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.681032"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-09T07:52:50.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "liweiyi ChestnutCMS download resourceDownload path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12923",
    "datePublished": "2025-11-10T00:32:06.381Z",
    "dateReserved": "2025-11-09T06:47:32.759Z",
    "dateUpdated": "2025-11-10T00:32:06.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}