CVE-2025-60786

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-60786
A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip file.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.icescrum.com/download/ Product
https://zdaylabs.com/CVE-2025-60786.html Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:kagilum:icescrum:*:*:*:*:pro:*:*:*
History

23 Dec 2025, 18:05

Type Values Removed Values Added
First Time Kagilum
Kagilum icescrum
CPE cpe:2.3:a:kagilum:icescrum:*:*:*:*:pro:*:*:*
References () https://www.icescrum.com/download/ - () https://www.icescrum.com/download/ - Product
References () https://zdaylabs.com/CVE-2025-60786.html - () https://zdaylabs.com/CVE-2025-60786.html - Exploit, Third Party Advisory

15 Dec 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-22

15 Dec 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-15 16:15

Updated : 2025-12-23 18:05

NVD link : CVE-2025-60786

Mitre link : CVE-2025-60786

CVE.ORG link : CVE-2025-60786

JSON object : View

Products Affected

kagilum

  • icescrum
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')