SecuriTricks - CVE-2025-63414

Description

A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).

Product(s) Impacted

Product	Versions

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414/

https://github.com/AllskyTeam/allsky

https://github.com/AllskyTeam/allsky/blob/master/html/execute.php

CVSS Score

10.0 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

View Vector String

Timeline

Published: Dec. 16, 2025, 5:16 p.m.
Last Modified: Dec. 18, 2025, 3:08 p.m.

Status : Undergoing Analysis

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

cve@mitre.org

CVE-2025-63414