What is CVE-2025-41035?

CVE-2025-41035 is a medium-severity vulnerability in Apprain, classified under Path Traversal. CVSS score: 6.5/10. Published 2025-09-04.

How severe is CVE-2025-41035?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Path Traversal in Apprain

CVE-2025-41035

A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apprain — versions 4.0.5
Apprain Cmf — versions 4.0.5

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve-coordination@incibe.es (Third Party Advisory)

Frequently asked questions

What is CVE-2025-41035?: CVE-2025-41035 is a medium-severity vulnerability in Apprain, classified under Path Traversal. CVSS score: 6.5/10. Published 2025-09-04.
How severe is CVE-2025-41035?: Medium severity. CVSS v3 base score is 6.5 out of 10.