CVE-2025-50971
Published: 26 August 2025
Summary
CVE-2025-50971 is a high-severity Path Traversal (CWE-22) vulnerability in Abantecart Abantecart. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 19.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-50971 is a directory traversal vulnerability affecting AbanteCart version 1.4.2. The flaw resides in the handling of the template parameter passed to index.php and is tracked under CWE-22. Unauthenticated remote attackers can supply crafted path sequences to retrieve arbitrary files from the underlying server filesystem.
An attacker with network access can exploit the issue without authentication or user interaction, achieving disclosure of sensitive system files such as configuration data or source code. The CVSS 3.1 score of 7.5 reflects the high confidentiality impact combined with the low attack complexity and absence of required privileges.
The single available reference is a public proof-of-concept demonstrating the traversal vector; no vendor advisory or patch information is provided in the supplied data. The associated EPSS score remains flat at 0.0129 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-26727
Vulnerability details
Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.