CVE-2025-26138

6.5 mediumEPSS 0.3%

Medium (6.5) in systemic-rm risk value. EPSS 0.3% chance of exploitation in the next 30 days.

Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do not have permission to view.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-11-01)
CWE: CWE-284
Published: 2025-03-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

systemic-rm:risk_value

References

https://github.com/Arakiba/CVEs/tree/main/CVE-2025-26138

Check your stack JSON