High severity · published Jul 22, 2025
CVE-2025-54141
ViewVC is a browser interface for CVS and Subversion version control repositories
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Viewvc · Viewvc
1.1.0 before 1.1.31; 1.2.0 before 1.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54141
Patch
https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7
Patch
https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84
Exploit
https://github.com/viewvc/viewvc/issues/211
Vendor Advisory
https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397
More from Viewvc
7.5
CVE-2007-5743
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option
6.1
CVE-2023-22456
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29
6.1
CVE-2017-5938
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web…
5.4
CVE-2023-22464
ViewVC is a browser interface for CVS and Subversion version control repositories
3.5
CVE-2020-5283
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support