CVE-2025-23410

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

When uploading organism or sequence data via the web interface, GMOD Apollo

will unzip and inspect the files and will not check for path traversal in supported archive types.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Mar 5, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-234116.5mySCADA myPRO Manager is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to obtain sensitive information. ACVE-2025-234127.5When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versCVE-2025-234134.4When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgauCVE-2025-234147.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This CVE-2025-234153.1An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attCVE-2025-234164.9Path traversal may lead to arbitrary file deletion. The score without least privilege principle violation is as calculated below. In combiCVE-2025-234177.5A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted CVE-2025-234185.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.CVE-2025-234194.3When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client ceCVE-2025-23425.3A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the CVE-2025-234207.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. CVE-2025-234216.4An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the ha
CVE-2025-23410: Critical severity, CVSS 9.8 | Vulnix