CVE-2025-55988
Published: 20 March 2026
Summary
CVE-2025-55988 is a high-severity Path Traversal (CWE-22) vulnerability in Dreamfactory Dreamfactory Core. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-55988 is a directory traversal vulnerability (CWE-22) in the /Controllers/RestController.php component of DreamFactory Core version 1.0.3. The flaw arises from an unsanitized URI path, enabling attackers to access files outside the intended directory. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-20.
Exploitation is network-accessible with low complexity and no user interaction required, but demands high privileges (PR:H) on the target system. A successful attack can achieve high impacts across confidentiality, integrity, and availability within the unchanged security scope.
Mitigation is addressed in a commit to the DreamFactory Core repository at https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756a5a22f6f56828950#diff-e57a7c0af25166ac8f02695307c6c413ca4ba0a48a20b2202ad910654528aab1. Further details appear in the Pentest Tools advisory on remote code execution via URL path traversal at https://pentest-tools.com/PTT-2025-001-RemoteCodeExecution-via-URL-Path-Traversal.pdf.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208913
Vulnerability details
An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public-facing web app component directly enables remote file access and RCE exploitation of the application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the directory traversal by requiring validation of unsanitized URI path inputs to block traversal sequences like '../'.
Addresses the specific flaw in /Controllers/RestController.php through timely identification, reporting, and correction via patching as shown in the referenced commit.
Enforces approved authorizations for logical access to files, limiting damage from successful path traversal attempts outside intended directories.