What is the CVSS score of CVE-2025-45145?

CVE-2025-45145 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Destiny Library Manager are affected by CVE-2025-45145?

Follett Software's Destiny Library Manager versions prior to 22.5 AU1 permit unauthorized remote access to student records, credentials, and system configuration files without authentication.

How to fix or mitigate CVE-2025-45145?

Within 24 hours: Identify all Destiny Library Manager deployments and confirm installed versions; immediately restrict network access to systems running versions prior to 22.5 AU1. Within 7 days: Develop and execute upgrade plan to version 22.5 AU1; conduct testing in non-production environment. Within 30 days: Deploy patched version to all production systems and perform audit of access logs to identify unauthorized file access.

Destiny Library Manager CVE-2025-45145

EUVD-2025-209923 HIGH

Path Traversal (CWE-22)

2026-05-22 mitre

GHSA-99w5-3688-qwj6

Path Traversal N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable traversal (PR:N/UI:N/AC:L) yielding arbitrary file read, so C:H but no integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:24 vuln.today

CVSS changed

Jul 05, 2026 - 02:22 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

May 22, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitrary system and application files via the image parameter

AnalysisAI

Arbitrary file disclosure in Follett Software's Destiny Library Manager (version 22_0_2_rc1) lets remote unauthenticated attackers read system and application files by supplying directory-traversal sequences in the 'image' parameter. Publicly available exploit code exists (a Medium write-up documenting the unauthenticated LFI), and CISA's SSVC framework classifies exploitation as proof-of-concept and automatable, though EPSS remains modest at 0.46% (64th percentile). The flaw is fixed in v.22.5 AU1.

Technical ContextAI

Destiny Library Manager is Follett's web-based library circulation and cataloging platform widely deployed across K-12 schools and districts. The vulnerability is a classic CWE-22 path/directory traversal: an HTTP-exposed 'image' parameter is used to build a filesystem path without properly canonicalizing or restricting it to an intended base directory, so traversal sequences (e.g., '../../') escape the web root and resolve to arbitrary files the application's service account can read. Because the parameter is reachable pre-authentication, this manifests as an unauthenticated local file inclusion/read against the application server. The CPE data provided is a placeholder ('cpe:2.3:a:n/a:n/a:*') and the EUVD affected-version field is 'n/a', so the exact affected build must be taken from the CVE description itself (22_0_2_rc1).

RemediationAI

Upgrade to the patched release - Vendor-released patch: v.22.5 AU1 - which remediates the traversal in the image-handling code; consult Follett (http://follett.com) for the district-specific update path and any intermediate builds. Until patched, restrict exposure by placing Destiny behind a VPN or IP allow-list so the application is not directly internet-reachable, and deploy a WAF or reverse-proxy rule to reject requests whose 'image' parameter contains traversal sequences or encoded variants ('../', '..%2f', '%2e%2e', absolute paths, null bytes); note WAF filtering is a mitigation, not a fix, and can be bypassed by novel encodings. Additionally ensure the Destiny service account runs with least privilege so that even a successful traversal reads as little sensitive data as possible, and monitor web logs for anomalous 'image' parameter values. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-45145 and the public technical write-up at https://medium.com/@jaredutahusa/cve-2025-45145-unauthenticated-local-file-inclusion-in-fsc-destiny-40a3f11b3a4d.