Read the docs
TI-2025-31136 Aliases CVE-2025-49008

Atheos Improper Input Validation Vulnerability Enables RCE in Common.php

Priority HIGH 76CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe_execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00648 51st percentileScored 2026-11-07
Fix Fixed Atheos (Atheos): 604

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtheosAtheosbefore 604604Patch availableCNA
  • Atheos VendorAtheos Affected before 604 Fixed in 604 Patch available CNA

Remediation

  • Fix · CNA Atheos (Atheos) Fixed in 604

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49008
  2. 2026-11-01 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2025-30253 Missing Path Validation Enables Path Traversal in Controller.php CVSS 4.0CRITICAL 9.4
  • TI-2025-16098 Improper Path Validation Enables Path Traversal in Multiple Components in Atheos CVSS 4.0CRITICAL 9.4
  • TI-2002-00233 Directory traversal vulnerability in chroot function in AtheOS 0.3.7 allows attackers to… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences