CVE-2025-2032

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	ChestnutCMS	1.5.2

References

https://github.com/IceFoxH/VULN/issues/7Exploit
https://vuldb.com/?ctiid.298774Permissions Required, VDB Entry
https://vuldb.com/?id.298774Third Party Advisory, VDB Entry
https://vuldb.com/?submit.512030Third Party Advisory, VDB Entry

Timeline

Published: Mar 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-203207.3In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and CVE-2025-203214.3In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and CVE-2025-203224.3In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, an CVE-2025-203234.3In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk CVE-2025-203245.4In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and CVE-2025-203255.3In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, an CVE-2025-203268.8A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Ses CVE-2025-203277.7A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of s CVE-2025-203285.4A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileg CVE-2025-203294.9A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenti CVE-2025-20338.8A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown funct CVE-2025-203306.1A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P