Path Traversal Vulnerability in PowerCMS by PowerCMS Co.
CVE-2025-41396

5.3MEDIUM

Key Information:

Vendor

Alfasado Inc.

Status
Powercms
Vendor
CVE Published:
31 July 2025

What is CVE-2025-41396?

A path traversal vulnerability exists in the file uploading feature of multiple versions of PowerCMS. This flaw enables authenticated users to manipulate file paths, allowing them to overwrite arbitrary files on the server. Such a security breach could lead to significant impacts on data integrity and system operations.

Affected Version(s)

PowerCMS 6.7 and earlier (PowerCMS 6.x series)

PowerCMS 5.3 and earlier (PowerCMS 5.x series)

PowerCMS 4.6 and earlier (PowerCMS 4.x series)

References

https://www.powercms.jp/news/release-powercms-671-531-461...
https://jvn.jp/en/vu/JVNVU93412964/

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.