CVE-2025-1743

Medium

Published: 27 February 2025

Published

27 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0756 92.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1743 is a medium-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-1743 is a path traversal vulnerability (CWE-22) classified as critical in zyx0814 Pichome version 2.1.0. The issue resides in an unknown functionality of the file /index.php?mod=textviewer, where manipulation of the "src" argument enables traversal outside intended directories. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting medium severity with low confidentiality impact and no effects on integrity or availability.

Any unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows limited disclosure of sensitive files via the path traversal, as indicated by the low confidentiality impact in the CVSS score. The exploit has been publicly disclosed and may be actively used.

Advisories and details are available from sources including a GitHub issue at https://github.com/sheratan4/cve/issues/4 and VulDB entries at https://vuldb.com/?ctiid.297831, https://vuldb.com/?id.297831, and https://vuldb.com/?submit.502168. No specific patch information is detailed in the available data.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7412

Vulnerability details

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely.…

The exploit has been disclosed to the public and may be used.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Path traversal in unauthenticated public web app enables remote file read (T1190 initial access + T1005 data collection).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1