What is the CVSS score of CVE-2025-40662?

CVE-2025-40662 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Dm Corporative Cms are affected by CVE-2025-40662?

CVE-2025-40662 is an unauthenticated path disclosure vulnerability in DM Corporative CMS that exposes absolute filesystem paths to remote attackers, enabling reconnaissance that typically precedes…. A patch is available.

How to fix or mitigate CVE-2025-40662?

Within 24 hours: Identify all DM Corporative CMS instances in your environment and confirm current installed versions. Within 7 days: Apply the vendor-released patch immediately to all affected systems; test in non-production environment first. Within 30 days: Conduct post-patch verification; review logs for exploitation attempts targeting /webroot/file directory with 404 responses; implement request logging and alerting for directory enumeration patterns.

Dm Corporative Cms CVE-2025-40662

EUVD-2025-17647 HIGH

Information Exposure (CWE-200)

2025-06-10 cve-coordination@incibe.es

Information Disclosure Path Traversal Dm Corporative Cms

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:43 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2025.01

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17647

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 10:15 nvd

HIGH 7.5

DescriptionCVE.org

Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a non-existent file.

AnalysisAI

CVE-2025-40662 is an absolute path disclosure vulnerability in DM Corporative CMS that exposes sensitive filesystem information when an attacker requests non-existent files within the webroot/file directory. This high-severity information disclosure (CVSS 7.5) affects DM Corporative CMS users and allows unauthenticated remote attackers to enumerate and discover the absolute filesystem paths of the application, which typically precedes further exploitation. The vulnerability has not been confirmed as actively exploited in the wild (KEV status unknown from provided data), but represents a significant reconnaissance vector with minimal attack complexity.

Technical ContextAI

This vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a common weakness in error handling and information disclosure. The underlying issue occurs in DM Corporative CMS's file handling mechanism within the webroot/file directory. When the application receives requests for non-existent files, it likely returns unfiltered error messages containing absolute filesystem paths (e.g., /var/www/html/webroot/file/nonexistent.txt), rather than generic error responses. This path disclosure occurs at the web application layer where error pages are rendered without sanitization. The vulnerability affects web-accessible file operations and suggests inadequate input validation or error suppression in the file request handler. The network-based attack vector (AV:N) indicates the flaw is exploitable remotely without any special access, and the lack of authentication requirement (PR:N) makes this particularly dangerous for reconnaissance.

RemediationAI

Patching: Apply the latest security patch from DM Corporative immediately once released. Monitor vendor security advisories for CVE-2025-40662-specific patches. 2) Error Suppression: Configure the application to return generic HTTP 404 error pages without revealing absolute paths in error messages or server headers. 3) Access Control: Restrict access to the webroot/file directory at the web server level (nginx/Apache) to authenticated users only if possible. 4) Web Application Firewall (WAF): Deploy rules to detect and block requests to non-existent files in /file/ paths and scrub absolute paths from responses. 5) Monitoring: Enable logging of file requests to detect reconnaissance activity targeting the /file/ directory. 6) Workaround: If patching is delayed, implement a reverse proxy or WAF rule that strips filesystem path information from HTTP responses before reaching clients. Consult DM Corporative's official security advisory (to be released) for version-specific patch URLs and timelines.