CVE-2025-2048

Description

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server

Reserved 2025-03-06 | Published 2025-04-01 | Updated 2025-04-01 | Assigner WPScan

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version before 1.10.0
affected

Credits

Bruno Oliveira - IncludeSecurity finder

WPScan coordinator

References

wpscan.com/...rability/05c664e8-110e-4a31-8377-41a0422508a7/ exploit vdb-entry technical-description

cve.org (CVE-2025-2048)

nvd.nist.gov (CVE-2025-2048)

Download JSON