{"id":"CVE-2025-15066","state":"PUBLISHED","title":"Arbitrary File Download through Path Traversal in Innorix WP","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This issue affects Innorix WP from All versions If the \"exam\" directory exists under the directory where the product is installed (ex: innorix/exam)","publishedAt":"2025-12-29T00:48:56.222Z","updatedAt":"2025-12-29T17:35:49.557Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"FSI"},"assigner":"FSI","products":["Innorix Innorix WP"],"affected":[{"vendor":"Innorix","product":"Innorix WP","defaultStatus":"unknown","versions":[{"version":"0","status":"unknown","lessThan":"*","versionType":"custom"}]}],"references":["https://www.innorix.com/","https://www.gnit.co.kr/software/innorix_product.html"],"weaknesses":["CWE-22","CWE-862"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/15xxx/CVE-2025-15066.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15066","state":"PUBLISHED","datePublished":"2025-12-29T00:48:56.222Z","dateUpdated":"2025-12-29T17:35:49.557Z","assignerShortName":"FSI","assignerOrgId":"09832df1-09c1-45b4-8a85-16c601d30feb","dateReserved":"2025-12-24T04:53:21.615Z"},"containers":{"cna":{"title":"Arbitrary File Download through Path Traversal in Innorix WP","descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This issue affects Innorix WP from All versions If the \"exam\" directory exists under the directory where the product is installed (ex: innorix/exam)"}],"affected":[{"vendor":"Innorix","product":"Innorix WP","defaultStatus":"unknown","versions":[{"version":"0","status":"unknown","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://www.innorix.com/"},{"url":"https://www.gnit.co.kr/software/innorix_product.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6.9,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"FSI","orgId":"09832df1-09c1-45b4-8a85-16c601d30feb","dateUpdated":"2025-12-29T00:48:56.222Z"},"credits":[{"lang":"en","type":"finder","value":"mak3bread(김민성, Minseong Kim)"}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-29T17:31:49.730389Z","id":"CVE-2025-15066","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-29T17:35:49.557Z"}}]}}}