The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478 | Exploit Third Party Advisory |
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478 | Exploit Third Party Advisory |
Configurations
History
09 Jul 2025, 19:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:syspass:syspass:*:*:*:*:*:*:*:* | |
| First Time |
Syspass syspass
Syspass |
28 Feb 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-28 23:15
Updated : 2025-07-09 19:30
NVD link : CVE-2025-25478
Mitre link : CVE-2025-25478
JSON object : View
Products Affected
syspass
- syspass
CWE
No CWE.