CVE-2025-11565

HighCVSS 7.3/10Last modified Oct 18, 2026

Description

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.

Metrics

CVSS 4.0 7.3/10

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-115666.9CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to CVE-2025-115677.3CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is n CVE-2025-115684.4A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker wit CVE-2025-11576.3A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the CVE-2025-115704.6Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficie CVE-2025-115712.1Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to exec CVE-2025-115737.5An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a speciall CVE-2025-115757.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects Mongo CVE-2025-115764.3The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versi CVE-2025-115777.6Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Polic CVE-2025-115787.2A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root CVE-2025-115796.5github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an