What is the CVSS score of CVE-2025-52574?

CVE-2025-52574 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-52574?

SysmonElixir versions before 1.0.1 expose a critical information disclosure risk: unauthenticated attackers can read arbitrary files from affected servers, including sensitive system credentials and…. A patch is available.

How to fix or mitigate CVE-2025-52574?

Within 24 hours: identify all instances of SysmonElixir and document current versions in use. Within 7 days: upgrade all affected SysmonElixir deployments to version 1.0.1 or later; verify upgrade completion and test /read endpoint functionality. Within 30 days: review logs for evidence of exploitation attempts to the /read endpoint and audit any files that may have been accessed during the exposure window.

Python CVE-2025-52574

EUVD-2025-18986 HIGH

Path Traversal (CWE-22)

2025-06-24 security-advisories@github.com

Path Traversal Information Disclosure Python

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:36 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.0.1

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-18986

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

CVE Published

Jun 24, 2025 - 03:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1.

AnalysisAI

SysmonElixir versions prior to 1.0.1 contain a path traversal vulnerability in the /read endpoint that allows unauthenticated remote attackers to read arbitrary files from the server, including sensitive system files like /etc/passwd. The vulnerability was patched in version 1.0.1 by implementing a whitelist restricting file reads to the priv/data directory. This is a high-severity information disclosure issue (CVSS 7.5) with no authentication required and network-accessible attack surface.

Technical ContextAI

SysmonElixir is an HTTP-based system monitoring service written in Elixir (functional programming language running on the Erlang VM). The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'), where user-supplied input to the /read endpoint is not properly validated before being passed to file system operations. The application fails to canonicalize or sanitize file paths, allowing attackers to use directory traversal sequences (e.g., ../, ../../) to escape intended directory boundaries and access arbitrary files readable by the service process. The patch introduced a whitelist-based approach that restricts all file operations to a controlled priv/data directory, implementing positive security controls rather than relying on blacklists.

RemediationAI

priority: CRITICAL; action: Upgrade SysmonElixir to version 1.0.1 or later immediately; implementation: Update dependency in mix.exs to {:sysmon_elixir, "~> 1.0.1"} or newer, then run 'mix deps.update sysmon_elixir' and redeploy
priority: HIGH; action: If immediate patching is not possible, implement network-level mitigations; implementation: ['Restrict network access to the SysmonElixir HTTP service using firewall rules (allow only trusted internal IPs)', 'Deploy a reverse proxy (nginx/Apache) with request filtering to block /read endpoint requests or validate path parameters', 'Run the service with minimal file system permissions (dedicated user with read-only access to priv/data only)']
priority: MEDIUM; action: Post-remediation verification; implementation: ['Audit logs for suspicious /read requests with path traversal patterns (../, etc.)', 'Scan systems for potential unauthorized file access or information disclosure', 'Review service process permissions and file system access controls']