Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2025-9259: WebITR allows attackers to download any system files
CVE-2025-9259 · published 1 year ago
Summary
The WebITR software, developed by Uniong, has a security weakness that lets unauthorized users access and download sensitive system files. This is a concern because it could allow hackers to steal confidential data or disrupt the system. To protect against this, update WebITR to the latest version or consider replacing it with a more secure alternative.
What to do
- Update uniong webitr to version 2_1_0_33 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| uniong | webitr |
< 2_1_0_33 cpe:2.3:a:uniong:webitr:*:*:*:*:*:*:*:* |
Original advisory text
WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
References
- https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-36Absolute Path Traversal
Timeline
Published22 Aug 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-9259 · NVD
Track software like this
Free during beta