Home

Description

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of system files.

PUBLISHED Reserved 2025-03-05 | Published 2025-04-16 | Updated 2025-04-16 | Assigner CERT-PL




HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-552 Files or Directories Accessible to External Parties

Product status

Default status
unaffected

7.0.0.0 (semver)
affected

8.0.0.0 (semver)
affected

Credits

Maksymilian Kubiak, Sławomir Zakrzewski, Jakub Stankiewicz - Afine Team finder

References

cert.pl/posts/2025/04/CVE-2025-1980 third-party-advisory

cert.pl/en/posts/2025/04/CVE-2025-1980 third-party-advisory

ready-os.com/pl/ product

cve.org (CVE-2025-1982)

nvd.nist.gov (CVE-2025-1982)

Download JSON