CVE-2025-67174
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via directory traversal in the admin_language_file and default_page_language_file parameters in the admin.php component.
Risk Assessment
The vulnerability may allow an attacker to read sensitive system, configuration, or credential files. The risk affects data confidentiality on servers running RiteCMS.
Recommendation
Update RiteCMS to a non-vulnerable version or apply a patch that restricts directory traversal. Also limit web server process privileges and audit file access.
Other vulnerabilities in RiteCMS
See all- CVE-2025-67173Medium
A Cross-Site Request Forgery (CSRF) vulnerability in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
- CVE-2025-67171High
Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal. The vulnerability enables reading files outside the intended directory.
- CVE-2025-67168Medium
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
- CVE-2025-67172High
RiteCMS v3.1.0 has an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.
Original NVD description (English source)
A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component
Vulnerability data from NVD (NIST) · CISA KEV · EPSS