Path Traversal in Appleple A-Blog Cms
CVE-2025-27566
Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with the administrator privilege may obtain or delete any file on the server.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.004 (36.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Appleple A-blog_cms
- Appleple Inc. A-blog Cms — versions prior to Ver. 3.1.43 (Ver. 3.1.x series), prior to Ver. 3.0.47 (Ver. 3.0.x series)
Weakness classification (CWE)
Public proof-of-concept exploits
References
- vultures@jpcert.or.jp (Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-27566?
- CVE-2025-27566 is a low-severity vulnerability in Appleple A-Blog Cms, classified under Path Traversal. CVSS score: 3.8/10. Published 2025-05-19.
- How severe is CVE-2025-27566?
- Low severity. CVSS v3 base score is 3.8 out of 10.
- Is CVE-2025-27566 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.