A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically extracted without validating or sanitizing file paths. An attacker can include traversal sequences (e.g., ../) in ZIP entries to write files outside the intended extraction directory. This allows static files (html, js, css, images) file write to unintended locations, or overwriting existing HTML files, potentially leading to content defacement and, in certain deployments, further impact if sensitive files are overwritten.
References
| Link | Resource |
|---|---|
| https://gist.github.com/Waqar-Arain/9cd59aa74de540eeb3b09d15bac35e36 | Exploit Third Party Advisory |
Configurations
History
09 Feb 2026, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Altumcode
Altumcode 66biolinks |
|
| References | () https://gist.github.com/Waqar-Arain/9cd59aa74de540eeb3b09d15bac35e36 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:altumcode:66biolinks:44.0.0:*:*:*:*:*:*:* |
02 Feb 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
29 Jan 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.1 |
28 Jan 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-28 19:16
Updated : 2026-02-09 17:25
NVD link : CVE-2025-69601
Mitre link : CVE-2025-69601
CVE.ORG link : CVE-2025-69601
JSON object : View
Products Affected
altumcode
- 66biolinks
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')