What is CVE-2025-48955?

CVE-2025-48955 is a medium-severity vulnerability in Erudika Para, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.2/10. Published 2025-06-02.

How severe is CVE-2025-48955?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Is CVE-2025-48955 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Erudika Para

CVE-2025-48955

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.

EPSS: 0.001 (4.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Erudika Para — versions < 1.50.8

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-48955?: CVE-2025-48955 is a medium-severity vulnerability in Erudika Para, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.2/10. Published 2025-06-02.
How severe is CVE-2025-48955?: Medium severity. CVSS v3 base score is 6.2 out of 10.
Is CVE-2025-48955 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.