CVE-2025-54141

HIGH EPSS 52.7%
Published Jul 22, 202511mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jul 22, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago

Description

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
52.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
viewvcviewvc*≥1.1.0  –  <1.1.31
viewvcviewvc*≥1.2.0  –  <1.2.4

References 4

  • github.com https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7
    Patch
  • github.com https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84
    Patch
  • github.com https://github.com/viewvc/viewvc/issues/211
    ExploitIssue Tracking
  • github.com https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397
    Vendor Advisory

Remediation

  • github.com https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7
    Patch
  • github.com https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84
    Patch