Vulnerability · Published Apr 21, 2025 · Assigned by MON-CSIRT
CVE-2025-0632Local File Inclusion (LFI) leading to sensitive data exposure
Critical 9.2
In plain English
A critical-severity path traversal in Rock Maker Web from Formulatrix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise. This issue affects Rock Maker Web: from 3.2.1.1 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Formulatrix | Rock Maker Web | 3.2.1.1 – through 3.18.3.2 |
Weakness: CWE-98, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N