CVE-2025-12059
Published: 11 February 2026
Summary
CVE-2025-12059 is a critical-severity Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations on files and directories to prevent unauthorized external access exploiting misconfigured access control security levels.
Ensures access control configurations are set to the most restrictive modes consistent with requirements, mitigating the incorrect security level configurations that expose sensitive information.
Identifies and applies the vendor-recommended upgrade to remediate the software flaw allowing insertion of sensitive data into externally accessible locations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of a public-facing application due to access control misconfiguration exposing sensitive files/directories.
NVD Description
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logo j-Platform: from 3.29.6.4 before 3.34.8.9.
Deeper analysisAI
CVE-2025-12059 is an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability (CWE-538) in Logo Software Industry and Trade Inc.'s Logo j-Platform. The flaw allows exploitation of incorrectly configured access control security levels, enabling sensitive data exposure. It affects Logo j-Platform versions from 3.29.6.4 before 3.34.8.9 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. Successful exploitation results in high impacts to confidentiality, integrity, and availability, potentially allowing full compromise of affected systems.
Mitigation requires upgrading to Logo j-Platform version 3.34.8.9 or later. Further details are provided in the advisory at https://www.usom.gov.tr/bildirim/tr-26-0061.
Details
- CWE(s)