CVE-2025-0632
Local File Inclusion (LFI) leading to sensitive data exposure
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Local File Inclusion (LFI) leading to sensitive data exposure
Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise. This issue affects Rock Maker Web: from 3.2.1.1 and later
Reserved 2025-01-22 | Published 2025-04-21 | Updated 2025-04-28 | Assigner MON-CSIRTCWE-98 Improper Control of Filename for Include
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Nicholas Page
www.formulatrix.com/downloads/apps/repository/rockmaker/
formulatrix.com/.../3.18.4.7/RockMakerWeb_3.18.4.7_setup.exe
formulatrix.com/...Maker/CVE-2025-0632_Security_Bulletin.pdf
Support options
