CVEvulnerability

CVE-2025-63414

10.0 CRITICAL Published 2025-12-16 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-12-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-78

Description

A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).

Affected configurations

• allskyteam allsky 2024.12.06 06

Related

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References