CVE-2026-25575
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-23
Limitación incorrecta de nombre de ruta relativa a un directorio restringido (Relative Path Traversal)
Fecha de publicación:
04/02/2026
Última modificación:
04/02/2026
Descripción
*** Pendiente de traducción *** NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7.
Impacto
Puntuación base 4.0
8.80
Gravedad 4.0
ALTA