CVE-2025-8021
Published: 23 July 2025
Summary
CVE-2025-8021 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.7 (High).
Operationally, ranked in the top 18.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-8021 is a directory traversal vulnerability, also known as path traversal and tracked under CWE-22, that affects all versions of the files-bucket-server package. The flaw allows an attacker to traverse the file system and read files outside the intended directory, corresponding to a CVSS 4.0 score of 7.7 driven by network attack vector, low complexity, no required privileges or user interaction, and high confidentiality impact.
An unauthenticated remote attacker can exploit the issue over the network to access sensitive files stored on the server hosting the package. The provided EPSS score remains flat at 0.0148 with no material increase after disclosure.
Public references include a technical gist detailing the path traversal vector and the Snyk advisory page for SNYK-JS-FILESBUCKETSERVER-9510944. No information on patches or specific mitigations is supplied in the available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22415
Vulnerability details
All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.