Takes TkFiles CVE-2025-66905

Requires that the target application expose the Takes framework's TkFiles take to serve files from a configured base directory over HTTP; exploitation then needs only an attacker-controlled request path containing ../ traversal sequences. No authentication, no user interaction, and no non-default configuration are required to read files (AV:N/AC:L/PR:N/UI:N), making any internet-reachable TkFiles-backed endpoint exploitable. The principal limiting factors are deployment-based rather than technical: the application must actually use TkFiles for file serving, must be running an affected version (through 2.0-SNAPSHOT), and the readable scope is bounded by the OS-level file permissions of the process running the framework. Impact is confined to confidentiality (arbitrary file read); there is no write/integrity or availability impact.

Signals are moderately consistent but point to a lower real-world priority than the 7.5 CVSS base score implies in isolation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a trivially reachable, unauthenticated, network-based file-read flaw with high confidentiality impact (C:H) and no integrity or availability impact (I:N/A:N), consistent with a classic unauthenticated path-traversal arbitrary-file-read. Publicly available exploit code exists (per the referenced GitHub report), which raises the operational likelihood of opportunistic use. However, this is NOT CISA KEV-listed and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - exploitation status is limited to 'publicly available exploit code exists', which is a distinct and weaker signal than confirmed in-the-wild abuse. The dominant mitigating factor is deployment footprint: Takes/TkFiles is a niche open-source Java web framework (yegor256/takes), not enterprise-ubiquitous software, so the aggregate real-world attack surface is small. Net assessment: technically a genuine, easy-to-exploit unauthenticated vulnerability that warrants prompt patching for anyone running it, but low organizational priority for most defenders due to limited prevalence and no KEV/active-exploitation evidence. No signals directly conflict; the main gap is the absence of EPSS data to quantify exploitation probability.

A remote, unauthenticated attacker sends an HTTP request to a service using the TkFiles take with a crafted path containing ../ sequences (e.g. requesting ../../../../etc/passwd), escaping the configured base directory and retrieving arbitrary host files such as configuration files, credentials, or source code. Because AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special conditions are needed, and public exploit/report material already documents the technique.