TI-2025-27387 Aliases CVE-2025-41035 GHSA-w4h7-75xh-3v83

Path Traversal vulnerability in appRain CMF

LOW 32CWE-22Published 2025-09-04 · Updated 2025-09-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00666 52nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
appRain	appRain CMF	4.0.5	—	No fix listed	CNA

appRain CMF VendorappRain Affected 4.0.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apprain:apprain:4.0.5:::::::*	4.0.5	Vulnerable	appRain

cpe:2.3:a:apprain:apprain:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·appRain

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-41035
2026-10-03 Alias added: GHSA-w4h7-75xh-3v83

References

Advisory 1

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf

TI-2024-38376 appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload CVSS 4.0HIGH 8.6
TI-2012-01059 Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF… CVSS 2.0MEDIUM 6.8
TI-2025-27386 SQL injection vulnerability in appRain CMF CVSS 4.0HIGH 8.7
TI-2025-27385 SQL injection vulnerability in appRain CMF CVSS 4.0HIGH 8.7
TI-2025-27384 SQL injection vulnerability in appRain CMF CVSS 4.0HIGH 8.7
TI-2013-05165 SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences