CVE-2025-12923
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In liweiyi ChestnutCMS up to 1.5.8, the resourceDownload function in /dev-api/common/download is vulnerable to path traversal via manipulation of the path argument. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker could exploit this to read arbitrary files from the server, potentially leading to disclosure of sensitive data, including configuration files or user data.
Recommendation
Update ChestnutCMS to a version containing a fix. If not possible, restrict access to the mentioned endpoint.
Other vulnerabilities in ChestnutCMS
See all- CVE-2026-36458Critical
ChestnutCMS version 1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered.
- CVE-2025-15009Medium
A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload. Manipulation of the argument File can lead to unrestricted upload, and the attack may be launched remotely.
Original NVD description (English source)
A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS