CVE-2025-22205

High

Published: 04 February 2025

Published

04 February 2025

Modified

04 June 2025

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0030 53.3th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22205 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Admiror-Design-Studio Admiror Gallery. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires identification, reporting, and remediation of the specific path traversal flaw in the Admiror Gallery extension for Joomla.

SI-10 Information Input Validation good match

prevent

Mandates validation of input variables to block path traversal attempts stemming from improper input handling.

SC-7 Boundary Protection partial match

prevent

Boundary protection at web interfaces can inspect and block malicious path traversal payloads targeting the Joomla extension.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing Joomla extension enables remote unauthenticated arbitrary file disclosure (T1190: Exploit Public-Facing Application) directly facilitating collection of sensitive data from the local filesystem such as configs (T1005: Data from Local System).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.

Deeper analysisAI

CVE-2025-22205 involves multiple path traversal vulnerabilities stemming from improper handling of input variables in the Admiror Gallery extension for Joomla, affecting the 4.x version branch. Classified under CWE-22 and CWE-35, the issue enables attackers to navigate outside intended directories. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high severity due to significant confidentiality risks.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation allows disclosure of arbitrary files on the affected server, potentially exposing sensitive data such as configuration files or user information, while integrity and availability remain unaffected.

Mitigation details are available in the vendor reference at http://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-gallery, published on 2025-02-04. Security practitioners should review this for patching instructions or workarounds specific to the Admiror Gallery extension.