CVE-2025-6866

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in code-projects Simple Forum 1.0 and classified as critical. This vulnerability affects unknown code of the file /forum_downloadfile.php. The manipulation of the argument filename leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
code-projects	Simple Forum	1.0

References

https://code-projects.org/Product
https://github.com/ez-lbz/poc/issues/22Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.314338Permissions Required, VDB Entry
https://vuldb.com/?id.314338Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603581Third Party Advisory, VDB Entry
https://github.com/ez-lbz/poc/issues/22Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-686605.4Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authen CVE-2025-686629.9Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue CVE-2025-686635.3Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket authentic CVE-2025-686648.2LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vul CVE-2025-686659.1LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain v CVE-2025-686666.5Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable CVE-2025-686679.9Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenti CVE-2025-686689.9n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python CVE-2025-686699.65ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE v CVE-2025-68677.2A vulnerability was found in SourceCodester Simple Company Website 1.0 and classified as critical. This issue affects some unknown processin CVE-2025-686709.8xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stem CVE-2025-686714.8lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps