What is the CVSS score of CVE-2025-48955?

CVE-2025-48955 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Para are affected by CVE-2025-48955?

Organizations using versions should be aware of moderate risk from CVE-2025-48955, a log file exposure vulnerability rated CVSS 6.2. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2025-48955?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Para CVE-2025-48955

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2025-06-02 security-advisories@github.com

GHSA-v75g-77vf-6jjq

Information Disclosure

6.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 12:15 nvd

MEDIUM 6.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on com.erudika:para-server (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.50.8.

DescriptionGitHub Advisory

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Insertion of Sensitive Information into Log File (CWE-532).