Path Traversal Vulnerability in appRain CMF Affected by Security Flaw
CVE-2025-41035

7.1HIGH

Key Information:

Vendor

Apprain

Status
Apprain Cmf
Vendor
CVE Published:
4 September 2025

What is CVE-2025-41035?

An authenticated Path Traversal vulnerability was identified in appRain CMF version 4.0.5, allowing remote users with sufficient permissions to bypass SecurityManager restrictions. This flaw permits unauthorized file downloads from locations outside the designated document root of the server using encoded base64 paths in download requests.

Affected Version(s)

appRain CMF 4.0.5

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.
CVE-2025-41035 : Path Traversal Vulnerability in appRain CMF Affected by Security Flaw