CVE-2022-25336

5.3 mediumEPSS 0.7%

Medium (5.3) in ibexa ez platform kernel. EPSS 0.7% chance of exploitation in the next 30 days.

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2022-02-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ibexa:ez_platform_kernel

References

https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization
https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization

Check your stack JSON