CVE-2025-25478

6.5 mediumEPSS 0.4%

Medium (6.5) in syspass syspass. EPSS 0.4% chance of exploitation in the next 30 days.

The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-73
Published: 2025-02-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

syspass:syspass

References

https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478
https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478

Check your stack JSON