CVE-2025-54118: NamelessMC allows sensitive information disclosure in member list component

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-18 · updated 2026-06-17
Weakness: CWE-200

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthenticated remote attacker to gain sensitive information such as absolute path of the source code via list parameter. This vulnerability is fixed in 2.2.4.

Affected products

NamelessMC Nameless: before 2.2.4 — fixed in 2.2.4

How to fix

Upgrade to a fixed version: NamelessMC Nameless 2.2.4. Check the vendor advisory for mitigations.

References

https://github.com/NamelessMC/Nameless/commit/3b94eb594dcbb1abc5524e41a0631df3ac95de8f
https://github.com/NamelessMC/Nameless/security/advisories/GHSA-cj37-8jqc-hv2w

Get alerted when CVE-2025-54118 or the next vulnerability affects your stack