{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57481?format=json","vulnerability_id":"VCID-fwas-eecc-3bau","summary":"Salt allows arbitrary directory creation or file deletion\nArbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.","aliases":[{"alias":"CVE-2025-22240"},{"alias":"GHSA-xh32-3m67-qjgf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/73744?format=json","purl":"pkg:pypi/salt@3006.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fxhr-smeg-k7fj"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.12"},{"url":"http://public2.vulnerablecode.io/api/packages/73745?format=json","purl":"pkg:pypi/salt@3007.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fxhr-smeg-k7fj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.4"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/66769?format=json","purl":"pkg:pypi/salt@3006.0rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-ce2x-ehyk-nufk"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-nehw-r7zm-j7bb"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/672649?format=json","purl":"pkg:pypi/salt@3006.0rc2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-ce2x-ehyk-nufk"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-nehw-r7zm-j7bb"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0rc2"},{"url":"http://public2.vulnerablecode.io/api/packages/672650?format=json","purl":"pkg:pypi/salt@3006.0rc3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-ce2x-ehyk-nufk"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-nehw-r7zm-j7bb"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0rc3"},{"url":"http://public2.vulnerablecode.io/api/packages/35630?format=json","purl":"pkg:pypi/salt@3006.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32tp-s4fd-v7h2"},{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-ce2x-ehyk-nufk"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-nehw-r7zm-j7bb"},{"vulnerability":"VCID-qr6n-rx38-6fd2"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.0"},{"url":"http://public2.vulnerablecode.io/api/packages/35631?format=json","purl":"pkg:pypi/salt@3006.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32tp-s4fd-v7h2"},{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-ce2x-ehyk-nufk"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-nehw-r7zm-j7bb"},{"vulnerability":"VCID-qr6n-rx38-6fd2"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.1"},{"url":"http://public2.vulnerablecode.io/api/packages/35632?format=json","purl":"pkg:pypi/salt@3006.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32tp-s4fd-v7h2"},{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-qr6n-rx38-6fd2"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.2"},{"url":"http://public2.vulnerablecode.io/api/packages/747924?format=json","purl":"pkg:pypi/salt@3006.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32tp-s4fd-v7h2"},{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-qr6n-rx38-6fd2"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-rnh5-7394-dfea"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.3"},{"url":"http://public2.vulnerablecode.io/api/packages/83259?format=json","purl":"pkg:pypi/salt@3006.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32tp-s4fd-v7h2"},{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-qr6n-rx38-6fd2"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.4"},{"url":"http://public2.vulnerablecode.io/api/packages/747925?format=json","purl":"pkg:pypi/salt@3006.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32tp-s4fd-v7h2"},{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-qr6n-rx38-6fd2"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.5"},{"url":"http://public2.vulnerablecode.io/api/packages/81946?format=json","purl":"pkg:pypi/salt@3006.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.6"},{"url":"http://public2.vulnerablecode.io/api/packages/828821?format=json","purl":"pkg:pypi/salt@3006.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.7"},{"url":"http://public2.vulnerablecode.io/api/packages/828822?format=json","purl":"pkg:pypi/salt@3006.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.8"},{"url":"http://public2.vulnerablecode.io/api/packages/828823?format=json","purl":"pkg:pypi/salt@3006.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.9"},{"url":"http://public2.vulnerablecode.io/api/packages/828824?format=json","purl":"pkg:pypi/salt@3006.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.10"},{"url":"http://public2.vulnerablecode.io/api/packages/828825?format=json","purl":"pkg:pypi/salt@3006.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"},{"vulnerability":"VCID-zudw-npmj-2qe8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.11"},{"url":"http://public2.vulnerablecode.io/api/packages/85466?format=json","purl":"pkg:pypi/salt@3007.0rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.0rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/85491?format=json","purl":"pkg:pypi/salt@3007.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.0"},{"url":"http://public2.vulnerablecode.io/api/packages/828826?format=json","purl":"pkg:pypi/salt@3007.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.1"},{"url":"http://public2.vulnerablecode.io/api/packages/828827?format=json","purl":"pkg:pypi/salt@3007.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.2"},{"url":"http://public2.vulnerablecode.io/api/packages/828828?format=json","purl":"pkg:pypi/salt@3007.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-34yz-hgbf-abee"},{"vulnerability":"VCID-em78-j177-kffg"},{"vulnerability":"VCID-fwas-eecc-3bau"},{"vulnerability":"VCID-fwpy-42pu-8ub3"},{"vulnerability":"VCID-r4b7-j6au-fucm"},{"vulnerability":"VCID-sc4b-v7j2-byed"},{"vulnerability":"VCID-t99c-dqd5-ukfk"},{"vulnerability":"VCID-yt34-n551-1uau"},{"vulnerability":"VCID-zeat-rzj9-u3br"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3007.3"}],"references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-22240","reference_id":"","reference_type":"","scores":[{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26346","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.2639","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26398","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-22240"},{"reference_url":"https://docs.saltproject.io/en/3006/topics/releases/3006.12.html","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-13T13:40:39Z/"}],"url":"https://docs.saltproject.io/en/3006/topics/releases/3006.12.html"},{"reference_url":"https://docs.saltproject.io/en/3007/topics/releases/3007.4.html","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-13T13:40:39Z/"}],"url":"https://docs.saltproject.io/en/3007/topics/releases/3007.4.html"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/saltstack/salt","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/saltstack/salt"},{"reference_url":"https://github.com/saltstack/salt/commit/f7c28ffbf18dbf693a15b1ba9493918de3e88cf3","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/saltstack/salt/commit/f7c28ffbf18dbf693a15b1ba9493918de3e88cf3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22240","reference_id":"CVE-2025-22240","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22240"},{"reference_url":"https://github.com/advisories/GHSA-xh32-3m67-qjgf","reference_id":"GHSA-xh32-3m67-qjgf","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-xh32-3m67-qjgf"}],"weaknesses":[{"cwe_id":22,"name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"4.0 - 6.9","exploitability":"0.5","weighted_severity":"6.2","risk_score":3.1,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fwas-eecc-3bau"}