CVE-2025-11941

MediumPublic PoC

Published: 19 October 2025

Published

19 October 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS Score 0.0011 29.0th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11941 is a medium-severity Path Traversal (CWE-22) vulnerability in E107 E107. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires identification, reporting, and correction of the path traversal flaw in the e107 CMS Avatar Handler component.

SI-10 Information Input Validation good match

prevent

Enforces validation of the multiaction[] input parameter to block path traversal sequences like ../ in remote requests.

AC-3 Access Enforcement partial match

prevent

Enforces logical access controls on files and directories to limit damage from successful path traversal by low-privileged users.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Path traversal vulnerability in public-facing e107 CMS admin endpoint directly enables exploitation of public-facing web applications (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the…

attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2025-11941 is a path traversal vulnerability (CWE-22) affecting e107 CMS versions up to 2.3.3. The issue resides in an unknown function within the Avatar Handler component, specifically the file /e107_admin/image.php?mode=main&action=avatar. By manipulating the multiaction[] argument, attackers can traverse paths outside the intended directory.

The vulnerability has a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), indicating medium severity. Exploitation requires low privileges, such as authenticated access to the admin interface, and can be performed remotely with low complexity and no user interaction. Successful attacks enable limited integrity and availability impacts, such as unauthorized file modifications or deletions via path traversal, but no confidentiality loss.

Advisories from VulDB and related disclosures note that the vendor was contacted early but provided no response, implying no official patch is available. References include proof-of-concept details, and the exploit is public, increasing the risk of active use against unpatched instances.