CVE-2025-41754

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1242

Affected software

VendorProductVersions
MBSUBR-01 Mk II>= 0.0.0, < 6.0.1.0
MBSUBR-02>= 0.0.0, < 6.0.1.0
MBSUBR-LON>= 0.0.0, < 6.0.1.0

References

Timeline

Published
Mar 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-417556.5A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint acceptCVE-2025-417568.1A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitraCVE-2025-417578.8A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and doeCVE-2025-417588.8A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this CVE-2025-417594.9An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not suppCVE-2025-41769.8A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affectsCVE-2025-417604.9An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not CVE-2025-417617.8A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system acCVE-2025-417626.2An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to senCVE-2025-417636.5A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators,CVE-2025-417649.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arCVE-2025-417659.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply ar
CVE-2025-41754: Medium severity, CVSS 6.5 | Vulnix