CVE-2025-59819

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-59827.5An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. UndCVE-2025-598206.7In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.CVE-2025-598216.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’sCVE-2025-598227.5Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTCVE-2025-598239.9Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in GaCVE-2025-598245.4Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potentialCVE-2025-598256.1astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives maCVE-2025-598267.6Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing CVE-2025-598279.8Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowinCVE-2025-598289.8Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins areCVE-2025-598296.5Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user CVE-2025-59836.5The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
CVE-2025-59819: Medium severity, CVSS 6.5 | Vulnix