Read the docs
TI-2025-30253 Aliases CVE-2025-47788

Missing Path Validation Enables Path Traversal in Controller.php

Priority HIGH 76CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was not properly validated, which could allow an attacker to execute arbitrary files on the server via path traversal. v602 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix Fixed Atheos (Atheos): 602

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtheosAtheosbefore 602602Patch availableCNA
  • Atheos VendorAtheos Affected before 602 Fixed in 602 Patch available CNA

Remediation

  • Fix · CNA Atheos (Atheos) Fixed in 602

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47788

References

Other 2

  • TI-2025-31136 Atheos Improper Input Validation Vulnerability Enables RCE in Common.php CVSS 4.0CRITICAL 9.4
  • TI-2025-16098 Improper Path Validation Enables Path Traversal in Multiple Components in Atheos CVSS 4.0CRITICAL 9.4
  • TI-2002-00233 Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences