CVE-2025-29930

imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the application could allow an attacker to read sensitive files on the server (Local File Inclusion, LFI). The $_GET['seoOp'] and $_GET['seoArg'] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that the ImpressCMS sensitive files are stored outside the web root, in a folder with a randomized name. The issue has been resolved in imFaq 1.0.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ImpressModules/imfaq/commit/63dedd30a8f196db7b340740adf667a39c26a4ac
https://github.com/ImpressModules/imfaq/security/advisories/GHSA-vrr3-54vc-vwg3

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) imFAQ es un sistema avanzado de gestión de preguntas y respuestas para ImpressCMS. En versiones anteriores a la versión 1.0.1, si el parámetro $_GET['seoOp'] se manipulaba para incluir información maliciosa (p. ej., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), la aplicación podía permitir que un atacante leyera archivos confidenciales del servidor (Inclusión de Archivos Locales, LFI). Los parámetros $_GET['seoOp'] y $_GET['seoArg'] se utilizan directamente sin depuración ni validación. Esto se mitiga en parte porque los archivos confidenciales de ImpressCMS se almacenan fuera del root web, en una carpeta con un nombre aleatorio. Este problema se ha resuelto en imFaq 1.0.1.

18 Mar 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-18 19:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-29930

Mitre link : CVE-2025-29930

CVE.ORG link : CVE-2025-29930

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2025-29930", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-18T19:15:51.340", "references": [{"url": "https://github.com/ImpressModules/imfaq/commit/63dedd30a8f196db7b340740adf667a39c26a4ac", "source": "security-advisories@github.com"}, {"url": "https://github.com/ImpressModules/imfaq/security/advisories/GHSA-vrr3-54vc-vwg3", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the application could allow an attacker to read sensitive files on the server (Local File Inclusion, LFI). The $_GET['seoOp'] and $_GET['seoArg'] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that the ImpressCMS sensitive files are stored outside the web root, in a folder with a randomized name. The issue has been resolved in imFaq 1.0.1."}, {"lang": "es", "value": "imFAQ es un sistema avanzado de gesti\u00f3n de preguntas y respuestas para ImpressCMS. En versiones anteriores a la versi\u00f3n 1.0.1, si el par\u00e1metro $_GET['seoOp'] se manipulaba para incluir informaci\u00f3n maliciosa (p. ej., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), la aplicaci\u00f3n pod\u00eda permitir que un atacante leyera archivos confidenciales del servidor (Inclusi\u00f3n de Archivos Locales, LFI). Los par\u00e1metros $_GET['seoOp'] y $_GET['seoArg'] se utilizan directamente sin depuraci\u00f3n ni validaci\u00f3n. Esto se mitiga en parte porque los archivos confidenciales de ImpressCMS se almacenan fuera del root web, en una carpeta con un nombre aleatorio. Este problema se ha resuelto en imFaq 1.0.1."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}