EUVD-2025-19504CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.
Analysis
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.
Technical ContextAI
Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'. This vulnerability is classified as Improper Input Validation (CWE-20).
RemediationAI
Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.
More from same product – last 7 days
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Authentication-context bypass in pam_usb before 0.9.0 lets a person holding an enrolled USB device authenticate over SSH
pam_usb prior to 0.9.0 crashes under memory pressure due to assert()-based OOM guards in src/mem.c that are silently str
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removin
In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on s
Vendor StatusVendor
Ubuntu
Priority: Low| Release | Status | Version |
|---|---|---|
| plucky | ignored | end of life, was needs-triage |
| focal | released | 0~git20200305.a717479+dfsg-1ubuntu0.1~esm2 |
| jammy | released | 0.1+dfsg-2ubuntu0.2 |
| noble | released | 0.1+dfsg-4ubuntu1.1 |
| oracular | ignored | end of life, was needs-triage |
| questing | released | 0.1+dfsg-4.2ubuntu0.1 |
| upstream | released | - |
Debian
Bug #1109341| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 0.1+dfsg-2+deb11u1 | - |
| bullseye (security) | fixed | 0.1+dfsg-2+deb11u1 | - |
| bookworm | fixed | 0.1+dfsg-4+deb12u1 | - |
| trixie | fixed | 0.1+dfsg-4.2+deb13u1 | - |
| forky, sid | fixed | 0.1+dfsg-4.3 | - |
| (unstable) | fixed | 0.1+dfsg-4.3 | - |
Share
External POC / Exploit Code
Leaving vuln.today