CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-28055: upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit
Description
upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit
Classification
CVE ID: CVE-2025-28055
Affected Products
Vendor: n/a
Product: n/a
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.06% (probability of being exploited)
EPSS Percentile: 17.99% (scored less or equal to compared to others)
EPSS Date: 2025-06-11 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-28055https://github.com/shinnku-nikaidou/upset-gal-web/issues/132
https://gist.github.com/LTLTLXEY/eb5e07436e0fcaca9747cd4467055f14