CVE-2025-4329

A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/download/index. The manipulation of the argument url leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-22

• https://github.com/Q16G/cve_detail/blob/main/74cms/fileRead.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.307430Permissions Required, VDB Entry
• https://vuldb.com/?id.307430Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.564318Third Party Advisory, VDB Entry
• https://github.com/Q16G/cve_detail/blob/main/74cms/fileRead.mdExploit, Third Party Advisory

Published

May 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43284An out-of-bounds read was addressed with improved bounds che…5.5
• CVE-2025-43285A permissions issue was addressed with additional restrictio…5.5
• CVE-2025-43286A permissions issue was addressed with additional restrictio…7.8
• CVE-2025-43287The issue was addressed with improved memory handling. This …7.1
• CVE-2025-43288This issue was addressed with improved validation of symlink…5.5
• CVE-2025-43289A logic issue was addressed with improved validation. This i…5.5
• CVE-2025-43290A permissions issue was addressed with additional restrictio…5.5
• CVE-2025-43291A permissions issue was addressed by removing the vulnerable…5.5
• CVE-2025-43292A race condition was addressed with improved state handling.…5.5
• CVE-2025-43293The issue was addressed with improved input validation. This…5.5
• CVE-2025-43294An issue existed in the handling of environment variables. T…3.3
• CVE-2025-43295A denial-of-service issue was addressed with improved valida…5.5