Cyber Resilience

CVE-2025-50348

HighPublic PoC

Published: 23 June 2025

Published
23 June 2025
Modified
25 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0151 81.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50348 is a high-severity Path Traversal (CWE-22) vulnerability in Phpgurukul Pre-School Enrollment System. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to directory traversal in the update-class-pic.php component, corresponding to CWE-22. The issue received a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and no required privileges or user interaction, with impacts limited to high confidentiality exposure.

An unauthenticated remote attacker can supply crafted path sequences through the affected script to read arbitrary files outside the intended web root, potentially disclosing configuration data, source code, or other sensitive server content.

The two provided references consist of GitHub documentation describing the directory traversal vector but contain no advisory statements or patch guidance. The associated EPSS score remains flat at 0.0151 with no observed increase after disclosure.

EU & UK References

Vulnerability details

PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-class-pic.php.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Directory traversal in public-facing web application (update-class-pic.php) enables exploitation of public-facing application (T1190), file and directory discovery (T1083), and collection of data from local system files (T1005).

Affected Assets

phpgurukul
pre-school enrollment system
1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References