Skip to main content

Files or Directories Accessible to External Parties

CVE-2025-45529

High
7.1/10

Summary

An arbitrary file read vulnerability in the "ReadTextAsynchronous" function of SSCMS allows attackers to read arbitrary files by sending a crafted GET request to "/cms/templates/templatesAssetsEditor".

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-552 - Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References

Advisory Timeline

  • Published