Vulnerabilities

TI-2025-27292 CVE-2025-40898 · GHSA-m6g9-g34g-jmjf

Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0

LOW 34

A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00402 Published 2025-12-18 Fixed in 25.5.0 CWE-22

TI-2025-27287 CVE-2025-40893 · GHSA-wg8q-pmvg-p6gw

HTML injection in Asset List in Guardian/CMC before 25.5.0

LOW 23

A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00195 Published 2025-12-18 Fixed in 25.5.0 CWE-79

TI-2025-27286 CVE-2025-40892 · GHSA-6726-7rcj-cq84

Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0

LOW 33

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter.

CVSS 4.0HIGH 7.1 Network Low privileges User interaction EPSS 0.00255 Published 2025-12-18 Fixed in 25.5.0 CWE-79

TI-2025-27285 CVE-2025-40891 · GHSA-q3xp-m695-72w5

HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0

LOW 11

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00176 Published 2025-12-18 Fixed in 25.5.0 CWE-79

Vulnerabilities

Filters

Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0

HTML injection in Asset List in Guardian/CMC before 25.5.0

Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0

HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0