CVE-2025-23410

9.3 criticalEPSS 0.7%

Critical (9.3). EPSS 0.7% chance of exploitation in the next 30 days.

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-23
Published: 2025-03-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07

Check your stack JSON