Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php
Priority MEDIUM 43CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0076 55th percentileScored 2026-11-07
Fix Fixed Pro Cloud Server (Sparx Systems): 6.0.165
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sparx Systems | Pro Cloud Server | up to 6.0.163 | 6.0.165 | Patch available | CNA |
- Pro Cloud Server VendorSparx Systems Affected up to 6.0.163 Fixed in 6.0.165 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sparxsystems:pro_cloud_server:*:*:*:*:*:*:*:* | — | — | Sparx Systems |
- cpe:2.3:a:sparxsystems:pro_cloud_server:*:*:*:*:*:*:*:* Versions — — ·Sparx Systems
Remediation
- Fix · CNA Pro Cloud Server (Sparx Systems) Fixed in 6.0.165
Timeline
- 2026-10-02 Threatist record created from CVE-2025-4377
- 2026-10-03 Alias added: GHSA-48q2-hf73-8f5p
References
More Sparx Systems vulnerabilities
- TI-2022-23300 SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to… CVSS 3.1CRITICAL 9.8
- TI-2026-30463 Authentication Bypass in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.3
- TI-2025-14252 Plaintext Storage of a Password in Sparx Pro Cloud Server. CVSS 4.0CRITICAL 9.3
- TI-2025-14251 Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user CVSS 4.0CRITICAL 9.3
- TI-2026-30462 Broken Access Control in Sparx Pro Cloud Server CVSS 4.0HIGH 8.7
- TI-2025-14253 Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.5
Sources
- CVE-2025-4377 · CVE Program
- CVE-2025-4377 · NVD
- FIRST EPSS
- GHSA-48q2-hf73-8f5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences