Command Injection in Atheos IDE Affects Self-Hosted Environments
CVE-2025-49008

9.4CRITICAL

Key Information:

Vendor

Atheos

Status
Atheos
Vendor
CVE Published:
5 June 2025

What is CVE-2025-49008?

Atheos IDE versions prior to 6.0.4 are susceptible to a command injection vulnerability due to improper handling of escapeshellcmd() in the execute.php file. This flaw allows users to manipulate input arguments, potentially resulting in arbitrary command execution that could compromise server security or lead to unauthorized data access. Atheos has addressed this issue in version 6.0.4 by implementing a new command execution method, Common::safe_execute, which utilizes escapeshellarg() to sanitize inputs, enhancing security against such exploits.

Affected Version(s)

Atheos < 604

References

https://github.com/Atheos/Atheos/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/Atheos/Atheos/commit/7e6c0eb45fa6d04d7...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.