CVE-2025-11941
Published: 19 October 2025
Summary
CVE-2025-11941 is a low-severity Path Traversal (CWE-22) vulnerability in E107 E107. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-11941 is a path traversal vulnerability (CWE-22) affecting e107 CMS versions up to 2.3.3. The issue resides in an unknown function within the Avatar Handler component, specifically the file /e107_admin/image.php?mode=main&action=avatar. By manipulating the multiaction[] argument, attackers can traverse paths outside the intended directory.
The vulnerability has a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), indicating medium severity. Exploitation requires low privileges, such as authenticated access to the admin interface, and can be performed remotely with low complexity and no user interaction. Successful attacks enable limited integrity and availability impacts, such as unauthorized file modifications or deletions via path traversal, but no confidentiality loss.
Advisories from VulDB and related disclosures note that the vendor was contacted early but provided no response, implying no official patch is available. References include proof-of-concept details, and the exploit is public, increasing the risk of active use against unpatched instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35005
Vulnerability details
A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the…
more
attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in public-facing e107 CMS admin endpoint directly enables exploitation of public-facing web applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the path traversal by validating the multiaction[] argument before it is used to access or modify files in the Avatar Handler.
Enforces access-control policy on file-system operations so that even an authenticated admin session cannot traverse outside the intended avatar directory.
Limits the privileges granted to the image.php avatar function, reducing the set of files that can be reached via the traversal.