GitHub Advisoryadvisory · Packagist

GHSA-xmh7-35v2-fp6h Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images

LOW Published 2025-11-30 Modified 2025-12-12 Official page ↗
Aliases
CVE-2025-13785
Ecosystem
Packagist
Packages
yungifez/skuul
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-12-12

Affected packages

• Packagist yungifez/skuul: <= 2.6.4 (no fix yet)

Description

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2025-13785 A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References