CVE-2025-49008

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe_execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.

• CWE-78
• CWE-88

• https://github.com/Atheos/Atheos/commit/7e6c0eb45fa6d04d786a0037389540f2638fe792
• https://github.com/Atheos/Atheos/security/advisories/GHSA-rwc2-4q8c-xj48
• https://github.com/Atheos/Atheos/security/advisories/GHSA-rwc2-4q8c-xj48

Published

Jun 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49002DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-49003DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-49004Caido is a web security auditing toolkit. Prior to version 0…7.5
• CVE-2025-49005Next.js is a React framework for building full-stack web app…3.7
• CVE-2025-49006Wasp (Web Application Specification) is a Rails-like framewo…8.2
• CVE-2025-49007Rack is a modular Ruby web server interface. Starting in ver…5.3
• CVE-2025-49009Para is a multitenant backend server/framework for object pe…6.2
• CVE-2025-4901A vulnerability classified as problematic was found in D-Lin…6.5
• CVE-2025-49010OpenSC is an open source smart card tools and middleware. Pr…6.8
• CVE-2025-49011SpiceDB is an open source database for storing and querying …5.3
• CVE-2025-49012Himmelblau is an interoperability suite for Microsoft Azure …5.4
• CVE-2025-49013WilderForge is a Wildermyth coremodding API. A critical vuln…9.9