What’s Vulnerable › Vulnerabilities

CVE-2025-41035: Path Traversal vulnerability in appRain CMF

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-04 · updated 2026-06-17
• Weakness: CWE-22

Description

A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.

Affected products

• appRain CMF: 4.0.5

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf

Get alerted when CVE-2025-41035 or the next vulnerability affects your stack