Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a portion of it) directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to the potential exposure of sensitive information.
References
| Link | Resource |
|---|---|
| https://gist.github.com/Captaince/99b728c792c72b2666c2400625702df0 | Exploit Third Party Advisory |
| https://github.com/AbelChe/cola_dnslog/issues/29 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
09 Jan 2026, 20:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/Captaince/99b728c792c72b2666c2400625702df0 - Exploit, Third Party Advisory | |
| References | () https://github.com/AbelChe/cola_dnslog/issues/29 - Exploit, Issue Tracking, Third Party Advisory | |
| First Time |
Abelche
Abelche cola Dnslog |
|
| CPE | cpe:2.3:a:abelche:cola_dnslog:1.3.2:*:*:*:*:*:*:* |
26 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-23 |
26 Dec 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-26 16:15
Updated : 2026-01-09 20:47
NVD link : CVE-2025-57403
Mitre link : CVE-2025-57403
CVE.ORG link : CVE-2025-57403
JSON object : View
Products Affected
abelche
- cola_dnslog
CWE
CWE-23
Relative Path Traversal