CVE-2025-22205

High

Published: 04 February 2025

Published

04 February 2025

Modified

04 June 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0030 53.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22205 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Admiror-Design-Studio Admiror Gallery. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22205 involves multiple path traversal vulnerabilities stemming from improper handling of input variables in the Admiror Gallery extension for Joomla, affecting the 4.x version branch. Classified under CWE-22 and CWE-35, the issue enables attackers to navigate outside intended directories. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high severity due to significant confidentiality risks.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation allows disclosure of arbitrary files on the affected server, potentially exposing sensitive data such as configuration files or user information, while integrity and availability remain unaffected.

Mitigation details are available in the vendor reference at http://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-gallery, published on 2025-02-04. Security practitioners should review this for patching instructions or workarounds specific to the Admiror Gallery extension.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2666

Vulnerability details

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.

CWE(s): CWE-35 CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing Joomla extension enables remote unauthenticated arbitrary file disclosure (T1190: Exploit Public-Facing Application) directly facilitating collection of sensitive data from the local filesystem such as configs (T1005: Data from Local System).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1