CVE-2025-52237

36th percentile - higher than 36% of all known CVEs

In SSCMS version 7.3.1, the component /stl/actions/download?filePath is vulnerable to directory traversal. This allows an attacker to read arbitrary files outside the intended directory.

An attacker can gain unauthorized access to sensitive configuration files, user data, or source code, leading to information disclosure and potential escalation of attacks.

Immediately update SSCMS to the latest version that fixes this vulnerability. Until then, restrict access to the /stl/actions/download component via firewall rules or authentication.