Medium severity · published Feb 28, 2025
CVE-2025-27413
PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json
4.9
CVSS
1.2%
EPSS
No
On KEV
Description
PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This is problematic for the template update functionality as it uses the path from the database to write arbitrary content to, potentially overwriting source code to achieve Remote Code Execution. Any user with the `backups:create`, `backups:update` and `templates:update` permissions (only administrators by default) can write arbitrary content to anywhere on the filesystem. By overwriting source code, it is possible to achieve Remote Code Execution. Version 1.2.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
pwndoc · pwndoc
< 1.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27413
Product
https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/models/template.js#L170-L175
Product
https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L826-L827
Product
https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/template.js#L63-L66
Patch
https://github.com/pwndoc/pwndoc/commit/68aa1ea676a91e17bfb333a27571151bd07fb21d
Release Notes
https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0
Exploit
https://github.com/pwndoc/pwndoc/security/advisories/GHSA-r3vj-47cf-4672
More from pwndoc
8.5
CVE-2024-55602
PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal
8.1
CVE-2025-23044
Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
6.5
CVE-2025-27410
PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin
6.5
CVE-2024-55652
PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters
6.5
CVE-2024-55653
pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)