{"id":"CVE-2025-0632","aliases":["EUVD-2025-12383","GHSA-qq86-38fr-rcf3"],"status":"published","title":"Local File Inclusion (LFI) leading to sensitive data exposure","description":"Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.\n\nThis issue affects Rock Maker Web: from 3.2.1.1 and later","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00934,"percentile":0.6105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-98"],"published":"2025-04-21T05:27:06Z","modified":"2026-06-17T08:26:52Z","products":[{"vendor":"formulatrix","product":"rock maker web"}],"references":[{"url":"https://www.formulatrix.com/downloads/apps/repository/rockmaker/"},{"url":"https://formulatrix.com/downloads/apps/repository/rockmaker/RockMaker%20V3/3.18/3.18.4.7/RockMakerWeb_3.18.4.7_setup.exe"},{"url":"https://formulatrix.com/downloads/docs/cve/RockMaker/CVE-2025-0632_Security_Bulletin.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0632"},{"url":"https://www.formulatrix.com/downloads/apps/repository/rockmaker"},{"url":"https://github.com/advisories/GHSA-qq86-38fr-rcf3"}],"sources":{"cve":[{"id":"CVE-2025-0632","title":"Local File Inclusion (LFI) leading to sensitive data exposure","description":"Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.\n\nThis issue affects Rock Maker Web: from 3.2.1.1 and later","status":"published","published":"2025-04-21T05:27:06.09Z","modified":"2025-04-28T02:49:47.566Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-98","CWE-22"],"updated_at":"2026-11-02T14:32:53.81273Z"}],"euvd":[{"id":"EUVD-2025-12383","description":"Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.\n\nThis issue affects Rock Maker Web: from 3.2.1.1 and later","status":"published","published":"2025-04-21T05:27:06Z","modified":"2025-04-28T02:49:47Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N","level":"critical"}],"updated_at":"2026-11-02T20:52:02.538258Z"}],"ghsa":[{"id":"GHSA-qq86-38fr-rcf3","title":"Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW)...","description":"Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.\n\nThis issue affects Rock Maker Web: from 3.2.1.1 and later","status":"published","published":"2025-04-21T06:30:31Z","modified":"2025-04-28T03:31:28Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:02.838203Z"}],"nvd":[{"id":"CVE-2025-0632","description":"Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.\n\nThis issue affects Rock Maker Web: from 3.2.1.1 and later","status":"published","published":"2025-04-21T06:15:44.043Z","modified":"2026-06-17T08:26:52.337Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-22","CWE-98"],"updated_at":"2026-11-02T14:11:01.507281Z"}]}}