CVE-2025-46822
Last modified
CVE-2025-46822 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. EPSS estimates a 3.96% chance of exploitation in the next 30 days.
Description
OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-46822?
How severe is CVE-2025-46822?
How do I fix CVE-2025-46822?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-46817Redis is an open source, in-memory database that persists on…8.8
- CVE-2025-46818Redis is an open source, in-memory database that persists on…7.3
- CVE-2025-46819Redis is an open source, in-memory database that persists on…7.1
- CVE-2025-4682The Essential Blocks – Page Builder Gutenberg Blocks, Patter…6.4
- CVE-2025-46820phpgt/Dom provides access to modern DOM APIs. Versions of ph…7.1
- CVE-2025-46821Envoy is a cloud-native edge/middle/service proxy. Prior to …5.3
- CVE-2025-46823openmrs-module-fhir2 provides the FHIR REST API and related …8
- CVE-2025-46824The Discourse Code Review Plugin allows users to review GitH…3.1
- CVE-2025-46825Kanboard is project management software that focuses on the …5.4
- CVE-2025-46826insa-auth is an authentication server for INSA Rouen. A mino…1.3
- CVE-2025-46827Graylog is a free and open log management platform. Prior to…5.4
- CVE-2025-46828WeGIA is a web manager for charitable institutions. An unau…9.8
Are you affected by CVE-2025-46822?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST