Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-2305

Local file inclusion vulnerability in LIVE CONTRACT

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cirosec

Description

A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SYNCPILOT LIVE CONTRACT

Default version status: unaffected

  • 3 to < 5.4.12affected
  • 5.5 to < 5.5.4affected
  • 5.6 to < 5.6.3affected

References