TaleLin Lin-CMS CVE-2025-15151

CRITICAL: This vulnerability requires the /tests directory and specifically the /tests/config.py file to be accessible remotely and not protected by authentication or access controls. The test folder must be present in the deployment (not removed during production build). The vulnerability only exists in environments where test configuration files are reachable over the network-standard production deployments with test artifacts excluded typically mitigate this. The attacker must be able to send HTTP requests with crafted username/password parameters to the config.py endpoint. No authentication is required (PR:N per CVSS vector), but access to the test folder itself is the primary limiting factor preventing widespread exploitation. Deployments using containerization or CI/CD practices that strip test files from production images are not vulnerable.

This vulnerability presents minimal real-world risk despite being publicly disclosed. Multiple signals indicate low practical impact: EPSS score of 0.04% (13th percentile) strongly suggests exploitation is uncommon or difficult in practice, contradicting the high CVSS score of 2.9. The CVSS vector confirms this incongruity-AC:H (high complexity) and the limited impact scope (VC:L for low confidentiality, no integrity or availability impact) restrict practical harm. The vulnerability requires network access but involves manipulation of test configuration files, which should not be exposed in typical production deployments. KEV status is not confirmed, and while the exploit has been publicly disclosed, the combination of high attack complexity and low EPSS exploitation probability suggests this remains theoretical rather than actively weaponized. The primary risk applies only to environments where test folders are accessible remotely and configuration files contain plaintext credentials.

An attacker scans a TaleLin Lin-CMS instance and discovers the /tests/config.py endpoint is accessible without authentication. The attacker sends HTTP requests with manipulated username and password parameters to the test configuration component, causing the application to write or expose credentials in the configuration file. The attacker retrieves the modified configuration file or observes the exposed credentials in error messages, gaining access to authentication data that may be reused across systems.