Improper Path Validation Enables Path Traversal in Multiple Components in Atheos
Priority HIGH 76CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00648 51st percentileScored 2026-11-07
Fix Fixed Atheos (Atheos): 600
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Atheos (Atheos) Fixed in 600
Timeline
- 2026-10-02 Threatist record created from CVE-2025-22152
- 2026-10-14 EPSS moved to the 50th–90th percentile
More Atheos vulnerabilities
- TI-2025-31136 Atheos Improper Input Validation Vulnerability Enables RCE in Common.php CVSS 4.0CRITICAL 9.4
- TI-2025-30253 Missing Path Validation Enables Path Traversal in Controller.php CVSS 4.0CRITICAL 9.4
- TI-2002-00233 Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to… CVSS 2.0HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences