CVE-2025-15227

HighCVSS 7.5

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

44th percentile - higher than 44% of all known CVEs

Summary

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.

Risk Assessment

An unauthenticated attacker could download sensitive system files, such as configuration files, passwords, or user data, potentially leading to a severe security breach.

Recommendation

Immediately apply patches provided by the vendor and restrict access to the application if possible.

Other vulnerabilities in BPMFlowWebkit

CVE-2025-15228Critical
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Original NVD description (English source)

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS