Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated…
Priority MEDIUM 41CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00972 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:abantecart:abantecart:1.4.2:*:*:*:*:*:*:* | 1.4.2 | Vulnerable | AbanteCart |
- cpe:2.3:a:abantecart:abantecart:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·AbanteCart
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-50971
- 2026-10-03 Alias added: GHSA-8xxr-vfmp-j2wv
References
More Abantecart vulnerabilities
- TI-2024-34112 A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function… CVSS 3.1MEDIUM 6.0
- TI-2024-34111 A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function… CVSS 3.1MEDIUM 6.0
- TI-2025-32280 SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to… CVSS 3.1CRITICAL 9.8
- TI-2022-09861 Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary… CVSS 3.1HIGH 7.2
- TI-2016-08793 AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to… CVSS 3.0HIGH 8.8
- TI-2018-14267 AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2025-50971 · CVE Program
- CVE-2025-50971 · NVD
- FIRST EPSS
- GHSA-8xxr-vfmp-j2wv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences