TI-2025-11057 Aliases CVE-2025-12059 GHSA-cj2c-wh4j-hw39

Improper Access Control in Logo Software's Logo j-Platform

MEDIUM 49CWE-538Published 2026-02-11 · Updated 2026-06-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Logo j-Platform: from 3.29.6.4 before 3.34.8.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00365 30th percentileScored 2026-11-07

Fix Fixed Logo j-Platform (Logo Software Industry and Trade Inc.): 3.34.8.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Logo Software Industry and Trade Inc.	Logo j-Platform	3.29.6.4 to before 3.34.8.9	3.34.8.9	Patch available	CNA

Logo j-Platform VendorLogo Software Industry and Trade Inc. Affected 3.29.6.4 to before 3.34.8.9 Fixed in 3.34.8.9 Patch available CNA

Remediation

Fix · CNA Logo j-Platform (Logo Software Industry and Trade Inc.) Fixed in 3.34.8.9

Timeline

2026-10-02 Threatist record created from CVE-2025-12059
2026-10-03 Alias added: GHSA-cj2c-wh4j-hw39

References

Other 2

TI-2026-07190 Stored XSS in Logo Software's e-Logo Purchasing Portal CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences