GitHub Advisoryadvisory · Packagist

GHSA-gv7f-w92j-383q DreamFactory has a directory traversal

HIGH Published 2026-03-20 Modified 2026-03-20 Official page ↗
Aliases
CVE-2025-55988
Ecosystem
Packagist
Packages
dreamfactory/df-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-03-20

Affected packages

• Packagist dreamfactory/df-core: < 1.0.4 → fixed in 1.0.4

Description

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.

Related

Alias · CVE (1)

  • CVE-2025-55988 An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References