What is CVE-2025-34119?

CVE-2025-34119 is a vulnerability in Tinasoft Easycafe Server, classified under Missing Authentication for Critical Function. Published 2025-07-16.

Is CVE-2025-34119 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Tinasoft Easycafe Server

CVE-2025-34119

A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its content is returned without authentication. This flaw allows attackers to retrieve sensitive files such as system configuration, password files, or application data.

Vulnerability class: Broken Authentication

Published 2025-07-16 · last modified 2026-06-17.

EPSS exploit prediction

EPSS: 0.022 (81.8th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.022 · change: +0.007

Affected products

Tinasoft Easycafe Server — versions 2.2.14

Weakness classification (CWE)

Public proof-of-concept exploits

rapid7/metasploit-framework

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/… (exploit)
www.exploit-db.com/exploits/39102 (exploit)
www.vulncheck.com/advisories/easy-cafe-server-remote-file-disclosure (third-party-advisory)

Frequently asked questions

What is CVE-2025-34119?: CVE-2025-34119 is a vulnerability in Tinasoft Easycafe Server, classified under Missing Authentication for Critical Function. Published 2025-07-16.
Is CVE-2025-34119 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.