Medium severity · published Aug 13, 2025
CVE-2025-8909
WellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Organization Portal System · WellChoose
through IFTOP_P3_2_1_196 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8909
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
More from Organization Portal System
9.8
CVE-2026-3826
WellChoose｜IFTOP - Local File Inclusion
9.8
CVE-2025-8913
WellChoose｜Organization Portal System - Local File Inclusion
7.5
CVE-2025-8914
WellChoose｜Organization Portal System - SQL Injection
7.5
CVE-2025-8912
WellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal
6.1
CVE-2026-3825
WellChoose｜IFTOP - Reflected Cross-site Scripting