RiteCMS CVE-2025-67171

Requires a network-reachable RiteCMS 3.1.0 instance with the /templates/ component accessible; the attacker supplies directory-traversal sequences to that component to read files outside the intended path. Per CVSS PR:N/UI:N, no authentication or user interaction is indicated, and the single affected version (3.1.0) limits exposure to that specific release. Impact is confined to confidentiality (reading sensitive files) - there is no integrity or availability effect - so the practical limit is the small population of deployed RiteCMS 3.1.0 instances rather than any special configuration requirement.

Signals are moderately consistent but point to a lower real-world priority than the 7.5 CVSS 'High' score alone suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact only (C:H/I:N/A:N), which aligns well with a CWE-22 directory traversal exposing sensitive files. Public exploit code exists (POC via a GitHub research repo), which raises practical exploitability. However, the vulnerability is NOT listed in CISA KEV, and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - the POC indicates capability, not confirmed abuse. The dominant mitigating factor is the target: RiteCMS is a niche flat-file CMS with a very small deployment footprint, so even a trivially exploitable unauthenticated read is unlikely to be mass-exploited. Net: a genuine, easily weaponizable information-disclosure bug, but realistically a low-to-moderate priority outside environments known to run RiteCMS 3.1.0. Note the description frames the issue as 'incorrect access control' combined with traversal - verify with the vendor/POC whether any authentication is actually required, as that would change the PR metric.

An unauthenticated remote attacker sends a crafted request to the RiteCMS /templates/ component using directory-traversal sequences (e.g. ../../) to escape the intended directory and read arbitrary sensitive files such as configuration or credential files. Public exploit code for CVE-2025-67171 is available on GitHub, lowering the skill required. Because the CVSS vector is AV:N/AC:L/PR:N, the request can be issued directly over the network against a reachable instance without user interaction.