CVE-2025-27410

MEDIUM
2025-02-28 [email protected]
6.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 18:29 vuln.today
Patch Released
Mar 28, 2026 - 18:29 nvd
Patch available
PoC Detected
Apr 16, 2025 - 13:04 vuln.today
Public exploit code
CVE Published
Feb 28, 2025 - 21:15 nvd
MEDIUM 6.5

Tags

RCE Path Traversal Pwndoc

Description

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.

Analysis

PwnDoc is a penetration test reporting application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 21.6%.

Technical Context

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue. Affected products include: Pwndoc Project Pwndoc. Version information: version 1.2.0.

Affected Products

Pwndoc Project Pwndoc.

Remediation

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

Priority Score

74
Low Medium High Critical
KEV: 0
EPSS: +21.6
CVSS: +32
POC: +20

Share

CVE-2025-27410 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy