Description

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine kritische Schwachstelle in zyx0814 Pichome 2.1.0 gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei /index.php?mod=textviewer. Mittels Manipulieren des Arguments src mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.

Classification

CVE ID: CVE-2025-1743

CVSS Base Severity: MEDIUM

CVSS Base Score: 6.9

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products

Vendor: zyx0814

Product: Pichome

Nuclei Template

http/cves/2025/CVE-2025-1743.yaml

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.06% (probability of being exploited)

EPSS Percentile: 16.55% (scored less or equal to compared to others)

EPSS Date: 2025-03-28 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: poc

SSVC Technical Impact: partial

SSVC Automatable: true

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1743
https://vuldb.com/?id.297831
https://vuldb.com/?ctiid.297831
https://vuldb.com/?submit.502168
https://github.com/sheratan4/cve/issues/4

Timeline