Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Admins can be tricked into downloading malicious files from websites

CVE-2025-25264 · published 1 year ago
Summary

An attacker can trick an admin into visiting a website with malicious code, which can then access sensitive files on the system. This is due to a policy that allows too many websites to access system files. To fix this, the CORS policy needs to be updated to be more restrictive, and admins should be cautious when visiting unknown websites.

Original advisory text
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files fro...
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-942Permissive Cross-domain Security Policy with Untrusted Domains
Timeline
Published16 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-25264 · NVD
Track software like this
Free during beta