TI-2025-33984 Aliases CVE-2025-54141

ViewVC's standalone server exposes arbitrary server filesystem content

HIGH 66CWE-22Published 2025-07-22 · Updated 2025-07-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Cross-site scripting
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22, CWE-79 and the CVSS impact.

Summary

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00851 58th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed viewvc (viewvc): 1.1.31, 1.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
viewvc	viewvc	1.1.0 to before 1.1.31; 1.2.0 to before 1.2.4	1.1.31, 1.2.4	Patch available	CNA

viewvc Vendorviewvc Affected 1.1.0 to before 1.1.31; 1.2.0 to before 1.2.4 Fixed in 1.1.31, 1.2.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:viewvc:viewvc::::::::	1.1.0 to before 1.1.31; 1.2.0 to before 1.2.4	Vulnerable	viewvc

cpe:2.3:a:viewvc:viewvc:*:*:*:*:*:*:*:* Versions 1.1.0 to before 1.1.31; 1.2.0 to before 1.2.4 Vulnerable ·viewvc

Remediation

Fix · CNA viewvc (viewvc) Fixed in 1.1.31, 1.2.4

Timeline

2026-10-02 Threatist record created from CVE-2025-54141

References

Exploit 1

https://github.com/viewvc/viewvc/issues/211

Patch 2

Advisory 1

https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397

TI-2023-08713 ViewVC XSS vulnerability in revision view changed path "copyfrom" locations CVSS 3.1MEDIUM 5.4
TI-2010-00005 query.py in the query interface in ViewVC before 1.1.3 does not reject configurations… CVSS 2.0HIGH 7.5
TI-2007-05516 viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. CVSS 3.1HIGH 7.5
TI-2006-05254 ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML… CVSS 2.0MEDIUM 6.8
TI-2017-03857 Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in… CVSS 3.0MEDIUM 6.1
TI-2023-08706 ViewVC XSS vulnerability in revision view changed paths CVSS 3.1MEDIUM 6.1

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences