CVE-2025-11182

MediumCVSS 6.5/10Last modified Oct 12, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-494

Affected software

Vendor	Product	Versions
GTONE	ChangeFlow	>= All versions, <= v9.0.1.1

References

http://www.gtone.co.kr/kr/application-lifecycle-management.php

Timeline

Published: Oct 2, 2025
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-111836.9Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript c CVE-2025-111846.9Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript c CVE-2025-111856.4The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-lin CVE-2025-111866.4The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_ac CVE-2025-111876.1Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or CVE-2025-111887.3The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise t CVE-2025-111897.3The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascr CVE-2025-11197.3The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode exe CVE-2025-111905.4The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attac CVE-2025-111915.3The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and CVE-2025-111928.6A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may auto CVE-2025-111935.5A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to s