Ragic Cloud Database CVE-2025-15015

Exploitation targets the file-download/retrieval functionality of Ragic Enterprise Cloud Database, abusing insufficient sanitization of relative path input (../ sequences) per CWE-23. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special attack prerequisites are required - a reachable, internet-exposed instance running the affected version is the only precondition. The primary limiting factor is network exposure: instances restricted to internal networks or behind access controls/WAF path-traversal filtering significantly reduce exploitability. Impact is limited to confidentiality (file read) only - no write, code execution, or availability effect is indicated.

Multiple signals point to a genuine but not emergency-level priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is fully remote, low-complexity, unauthenticated with no user interaction - the easiest-to-reach profile - and the 8.7 High score is driven entirely by confidentiality (VC:H) with no integrity or availability impact, consistent with an arbitrary-file-read/path-traversal flaw. Against that, the exploitation signals are modest: EPSS is only 0.61% (48th percentile), the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation - the high score reflects ease and potential impact, not observed attacks. Note a mild tension to verify: the low attack complexity and unauthenticated vector imply a very simple exploit, yet no POC is cited despite a TWCERT advisory, so exploit availability is unconfirmed. Net: a real, easily-exploitable confidentiality exposure worth prompt patching for exposed instances, but current telemetry suggests opportunistic rather than mass exploitation.

A remote, unauthenticated attacker sends a crafted request containing a relative path traversal sequence (e.g., ../../) to a download or file-handling endpoint of a Ragic Enterprise Cloud Database instance, causing the application to return files outside the intended directory. This lets the attacker retrieve sensitive system files such as configuration files, credentials, or source containing secrets. No public exploit code is referenced, but CVSS AC:L indicates the attack is straightforward to reproduce once the vulnerable parameter is identified.