Vulnerability · Published Nov 25, 2025 · Assigned by GitHub_M
CVE-2025-65952Console is vulnerable to path traversal regarding custom assets
High 8.7
In plain English
A high-severity path traversal in Console from iiDk-the-actual. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This issue has been patched in version 2.8.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| iiDk-the-actual | Console | < 2.8.0 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/iiDk-the-actual/Console/security/advisories/GHSA-c3f7-xh45-2xc7 x_refsource_CONFIRM
- https://github.com/iiDk-the-actual/Console/commit/4bcb1cf23ef78f8e6899dd6fe3afa3b24902e458 x_refsource_MISC
- https://github.com/iiDk-the-actual/Console/commit/e1005b8754594ad463ae58f8a99decda548b1826 x_refsource_MISC