CVE-2025-54141

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7	Patch
https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84	Patch
https://github.com/viewvc/viewvc/issues/211	Exploit Issue Tracking
https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:viewvc:viewvc::::::::
	cpe:2.3:a:viewvc:viewvc::::::::

History

No history.

Information

Published : 2025-07-22 22:15

Updated : 2025-08-05 17:17

NVD link : CVE-2025-54141

Mitre link : CVE-2025-54141

CVE.ORG link : CVE-2025-54141

JSON object : View

Products Affected

viewvc

viewvc

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-54141", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-07-22T22:15:38.537", "references": [{"url": "https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/viewvc/viewvc/issues/211", "tags": ["Exploit", "Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4."}, {"lang": "es", "value": "ViewVC es una interfaz de navegador para repositorios de control de versiones de CVS y Subversion. En las versiones 1.1.0 a 1.1.31 y 1.2.0 a 1.2.3, el script standalone.py incluido en la distribuci\u00f3n de ViewVC puede exponer el contenido del sistema de archivos del servidor host mediante un ataque de directory traversal. Esto se ha corregido en las versiones 1.1.31 y 1.2.4."}], "lastModified": "2025-08-05T17:17:58.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:viewvc:viewvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A68A5A4-DB0E-48E2-8036-51468875A48B", "versionEndExcluding": "1.1.31", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66230621-C765-45EE-94C9-67597CC2B40C", "versionEndExcluding": "1.2.4", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}