Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-63414 is a critical-severity Path Traversal (CWE-22) vulnerability in Allskyteam Allsky. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 25% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-63414 is a Path Traversal vulnerability (CWE-22) in the Allsky WebUI version v2024.12.06_06 that enables arbitrary command injection (CWE-78). The flaw resides in the /html/execute.php endpoint, where insufficient validation of the 'id' parameter allows attackers to traverse paths and execute OS commands. Published on 2025-12-16, it carries a maximum CVSS v3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low complexity, lack of privileges or user interaction required, and high impact across confidentiality, integrity, and availability with scope expansion.
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the 'id' parameter. Successful exploitation leads to full remote code execution (RCE) on the underlying operating system, potentially granting complete control over the affected Allsky WebUI instance.
References include a detailed advisory at https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414/, the Allsky GitHub repository at https://github.com/AllskyTeam/allsky, and the vulnerable source file at https://github.com/AllskyTeam/allsky/blob/master/html/execute.php. Security practitioners should review these for patch details, updates, or mitigation guidance directly from the vendor or researchers.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203804
Vulnerability Data
A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker…
more
can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V1.2.5V1.2.8V15.2.5
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Developer testing and evaluation can discover missing or incorrect command sanitization during development.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Least functionality restricts available OS commands and interpreters, limiting the blast radius of injection.
Secure engineering principles require proper neutralization of untrusted input before command construction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.