Log in Start free

Vulnerability · Published Jul 22, 2025 · Assigned by GitHub_M

CVE-2025-54141ViewVC's standalone server exposes arbitrary server filesystem content

High 7.5

In plain English

A high-severity path traversal in viewvc from viewvc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 41.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.

Affected products (as reported)

VendorProductVersions
viewvc viewvc >= 1.1.0, < 1.1.31>= 1.2.0, < 1.2.4

Weakness: CWE-22, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References