Path Traversal in Mpdv Mikrolab Gmbh Fedra 2
CVE-2025-12055
HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.036 (88.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Mpdv Mikrolab Gmbh Fedra 2 — versions <Maintenance Pack 36 with Servicepack 8, release week 36/2025
- Mpdv Mikrolab Gmbh Hydra X — versions <Maintenance Pack 36 with Servicepack 8, release week 36/2025
- Mpdv Mikrolab Gmbh Mip 2 — versions <Maintenance Pack 36 with Servicepack 8, release week 36/2025
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-12055?
- CVE-2025-12055 is a high-severity vulnerability in Mpdv Mikrolab Gmbh Fedra 2, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-10-27.
- How severe is CVE-2025-12055?
- High severity. CVSS v3 base score is 7.5 out of 10.