CVE-2025-2305

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-230503.1QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero).CVE-2025-230517.2An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. SCVE-2025-230527.2Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of thisCVE-2025-230536.5A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploiCVE-2025-230546.5A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege opeCVE-2025-230555.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to condCVE-2025-230565.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to condCVE-2025-230575.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to condCVE-2025-230588.1A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attaCVE-2025-230594.9A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitCVE-2025-23065.9An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensCVE-2025-230608.1A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information.
CVE-2025-2305: High severity, CVSS 8.6 | Vulnix