CVE-2025-52237
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In SSCMS version 7.3.1, the component /stl/actions/download?filePath is vulnerable to directory traversal. This allows an attacker to read arbitrary files outside the intended directory.
Risk Assessment
An attacker can gain unauthorized access to sensitive configuration files, user data, or source code, leading to information disclosure and potential escalation of attacks.
Recommendation
Immediately update SSCMS to the latest version that fixes this vulnerability. Until then, restrict access to the /stl/actions/download component via firewall rules or authentication.
Other vulnerabilities in SSCMS
See all- CVE-2026-7435High
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements.
- CVE-2026-7429Medium
SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses.
Original NVD description (English source)
An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS