CVE-2025-47788
Missing Path Validation Enables Path Traversal in Controller.php
Résumé
Missing Path Validation Enables Path Traversal in Controller.php
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the $target parameter in /controller.php was not properly validated, which could allow an attacker to execute arbitrary files on the server via path traversal. v602 contains a fix for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com