CVE-2025-67076

{"id": "CVE-2025-67076", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67076", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T16:11:35.960384Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-15T16:16:11.650", "references": [{"url": "https://www.agora-project.net", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.helx.io/blog/advisory-agora-project/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Omnispace Agora Project anterior a 25.10 que permite a atacantes no autenticados leer archivos en el sistema a trav\u00e9s del controlador misc y la acci\u00f3n ExternalGetFile. Solo se pueden leer archivos con una extensi\u00f3n."}], "lastModified": "2026-06-17T09:57:24.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:agora-project:agora-project:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03FDD8D6-01A9-4C64-9893-65C744702416", "versionEndExcluding": "25.10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}