CVE-2025-54141

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-541424.0Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequeCVE-2025-541439.8Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the pCVE-2025-541445.4The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or iCVE-2025-541459.1The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's opeCVE-2025-541466.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541476.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541486.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541495.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541505.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541515.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541526.5A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, theCVE-2025-541538.8An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t
CVE-2025-54141: High severity, CVSS 7.5 | Vulnix