CVE-2025-70820

LowCVSS 3.5/10Last modified Oct 14, 2026

Description

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-36

Affected software

No affected versions have been published.

Timeline

Published
Sep 13, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-708219.8renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java componentCVE-2025-708288.8An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configurationCVE-2025-708295.7An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC conCVE-2025-70838.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mpCVE-2025-708309.9A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackersCVE-2025-708319.8A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properCVE-2025-708339.4An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the aCVE-2025-70848.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. This vulnerability affects the function formWpsStart CVE-2025-708417.5Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuratiCVE-2025-708425.4A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenCVE-2025-708446.1yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function CVE-2025-708456.1lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly saniti
CVE-2025-70820: Low severity, CVSS 3.5 | Vulnix