What is the CVSS score of CVE-2025-41073?

CVE-2025-41073 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-41073?

Within 24 hours, confirm which systems run TESI Gandia Integra Total 4.4.2236.1 and restrict network reachability of the comprimir.php export endpoint to trusted administrative segments only; audit all active accounts for the affected platform and disable or expire any that are unused, shared, or not strictly required, since every valid low-privileged session is a potential exploitation path. Within 7 days, contact TESI Gandia to obtain a committed remediation timeline and any interim hardening guidance, request a fixed build number in writing, and deploy compensating controls such as a reverse proxy or WAF rule blocking parent-directory traversal sequences (for example ../, ..\, and encoded variants) on export requests while enabling detailed logging and alerting on export endpoint access to establish a baseline for detecting abnormal file-retrieval patterns. Within 30 days, upgrade to the vendor-released fixed version as soon as it is published - there is currently no patched release for 4.4.2236.1 - and if the vendor cannot confirm a fix within that window, initiate a formal risk acceptance or platform-replacement review with a documented decision owner; additionally, reduce the standing privilege footprint by enforcing least-privilege roles and reviewing whether the export feature can be disabled for non-administrative user groups until remediation is complete.

Gandia Integra Total CVE-2025-41073

HIGH

Path Traversal (CWE-22)

2025-10-23 cve-coordination@incibe.es

PHP Path Traversal Gandia Integra Total Tesigandia

7.1

CVSS 4.0 · Vendor: incibe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain valid app credentials
Delivery

Authenticate to Integra web interface
Exploit

Send comprimir.php request with traversal in direstudio param
Execution

Server zips parent-directory files
Impact

Download ZIP and exfiltrate sensitive files

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated session (PR:L) to TESI Gandia Integra Total version 4.4.2236.1; the attacker must reach the specific endpoint /encuestas/integraweb[_v4]/integra/html/view/comprimir.php and supply directory-traversal sequences (..\..\..) in the 'direstudio' parameter. No user interaction or non-default configuration is needed beyond having valid credentials and network access to the web application. The limiting factor is the authentication requirement - this cannot be exploited by fully unauthenticated remote attackers - and impact is confined to reading/exfiltrating server files (confidentiality only), with no write, modification, or denial-of-service capability.
Impact	This is a moderate-priority, not high-priority, issue. The CVSS 4.0 base of 7.1 is driven entirely by confidentiality (VC:H) with no integrity or availability impact (VI:N/VA:N) - it is a file-disclosure bug, not code execution. The vector shows network reach and low complexity (AV:N/AC:L/AT:N) but requires prior authentication (PR:L), which meaningfully limits the attacker population to those who already hold valid application credentials. Corroborating signals point away from urgent action: EPSS is 0.38% (29th percentile), there is no CISA KEV listing, and no public POC or exploit code was identified. There is no signal conflict here - all sources (vendor CVSS confidentiality-only scoring, low EPSS, absence of KEV/POC) consistently describe a real but bounded authenticated information-disclosure flaw. My independent 3.1 assessment lands slightly lower (~6.5) than the vendor's 4.0 score, both reflecting a single-impact (C:H) authenticated bug against a niche product.
Exploit ScenarioDerived	An attacker who already possesses valid low-privilege application credentials sends a crafted request to /encuestas/integraweb[_v4]/integra/html/view/comprimir.php with a 'direstudio' parameter containing directory-traversal sequences (e.g. ..\..\..). The server compresses and returns a ZIP containing files from arbitrary parent directories, allowing theft of configuration files, source code, or other sensitive server-side data. No public exploit code was identified at time of analysis, but the technique is trivial to reproduce once authenticated.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 30, 2026

Authenticated users of TESI Gandia Integra Total 4.4.2236.1 can abuse a path traversal flaw in the comprimir.php export function to force the server to build and return a ZIP archive containing files from outside the intended directory, including parent-directory paths reached with sequences such as ..\..\... Exploitation requires only a valid, low-privileged session and network access to the web interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so the impact is limited to confidentiality - there is no file write, modification, or denial-of-service capability - which makes this a moderate-priority rather than critical issue. No public exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is low at 0.38 percent (29th percentile), although the vendor/NVD CVSS 4.0 score of 7.1 reflects the high confidentiality impact.

RemediationAI

No vendor-released patch version was identified in the available advisory data at time of analysis, so the primary action is to check the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-gandia-integra-total-tesi) for an updated release from TESI and apply it as soon as it is published. Until then, block or restrict access to /encuestas/integraweb[_v4]/integra/html/view/comprimir.php at the reverse proxy or WAF for users who do not need the export feature, and add rules that reject requests whose 'direstudio' parameter contains traversal sequences (..\, ../ and their percent-encoded forms); the trade-off is that legitimate bulk exports may break for those users. If the ZIP export function is not required, disable or remove comprimir.php entirely, accepting the loss of that feature. In any custom code path, add server-side canonicalization plus a whitelist of allowed base directories for the 'direstudio' parameter, and constrain the web server account's filesystem permissions so it can only read the survey data directories it genuinely needs - this reduces, but does not eliminate, the set of files an attacker can exfiltrate. Because exploitation requires a valid authenticated session (PR:L), also review account provisioning, remove dormant or shared survey accounts, enforce least-privilege roles for the encuestas module, and alert on ZIP downloads from comprimir.php in web and proxy logs as a detection control.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in a PHP component of the Gandia Integra Total web application, which is used for municipal survey ('encuestas') workflows in Spanish local government. The endpoint /encuestas/integraweb[_v4]/integra/html/view/comprimir.php ('comprimir' is Spanish for compress) takes a user-supplied 'direstudio' parameter, uses it to select files on disk, and packages them into a downloadable ZIP archive without canonicalizing or constraining the resulting path to a permitted base directory. Supplying backslash traversal sequences (..\..\..) causes the archive to include files from directories above the intended folder, turning a legitimate bulk-export feature into an arbitrary-file-read/exfiltration primitive bounded only by the file permissions of the web server account. The CPE cpe:2.3:a:tesigandia:gandia_integra_total:4.4.2236.1 pinpoints the single affected build, and the fact that the vulnerable script is referenced under both 'integraweb' and 'integraweb_v4' path variants indicates the same flawed code shipped in more than one deployed folder layout.

Know when Gandia Integra Total gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (incibe) PRIMARY 7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 6.5 MEDIUM

Remote authenticated attacker (PR:L) exploits a low-complexity traversal to read arbitrary server files; confidentiality-only impact, so I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (incibe).

CVSS VectorVendor: incibe

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated attacker to download a ZIP file containing files from the server, including those located in parent directories (e.g., ..\..\..), by exploiting the “direstudio” parameter in “/encuestas/integraweb[_v4]/integra/html/view/comprimir.php”.

Executive ViewAI

Why It Matters

An authenticated user of TESI Gandia Integra Total 4.4.2236.1 - the version currently in use - can manipulate a web export function to pull arbitrary files from the underlying server, potentially exposing configuration data, credentials, or other sensitive records to anyone holding even a basic account. Because the flaw requires only a valid low-privilege login and no special tooling, the practical exposure is driven by how widely accounts are issued and how well access is governed rather than by external attacker interest, which remains low. Leadership should treat this as a data-confidentiality and access-governance risk affecting the integrity of the platform's trust boundary, not as an immediate operational outage threat.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the affected web interface and export endpoint to trusted segments; enforce least-privilege account provisioning and aggressively prune unused or shared credentials; deploy proxy/WAF filtering to block path traversal sequences in export requests; disable the export functionality for non-administrative users where feasible; and enable logging and monitoring of export endpoint usage to detect anomalous file-retrieval activity.

Threat Intelligence Overview

EPSS Score

0.4%

Top 71% exploitable

Prevalence

Low

niche Spanish survey/research software, limited industry-specific footprint

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.