{"id":"CVE-2025-25048","aliases":["EUVD-2025-26723","GHSA-frpg-jh29-93cv"],"status":"published","title":"IBM Jazz Foundation path traversal","description":"IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00328,"percentile":0.26039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-23"],"published":"2025-09-04T15:06:15Z","modified":"2026-06-17T09:00:12Z","products":[{"vendor":"ibm","product":"jazz foundation"},{"vendor":"ibm","product":"jazz_foundation"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7244014","tags":["vendor-advisory","patch","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25048"},{"url":"https://github.com/advisories/GHSA-frpg-jh29-93cv"}],"sources":{"cve":[{"id":"CVE-2025-25048","title":"IBM Jazz Foundation path traversal","description":"IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.","status":"published","published":"2025-09-04T15:06:15.076Z","modified":"2025-09-04T15:16:08.257Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-26723","description":"IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.","status":"published","published":"2025-09-04T15:06:15Z","modified":"2025-09-04T15:16:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:47.35544Z"}],"ghsa":[{"id":"GHSA-frpg-jh29-93cv","title":"IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7...","description":"IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.","status":"published","published":"2025-09-04T15:30:28Z","modified":"2025-09-04T15:30:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:03:28.945171Z"}],"nvd":[{"id":"CVE-2025-25048","description":"IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.","status":"published","published":"2025-09-04T15:15:46.077Z","modified":"2026-06-17T09:00:12.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:11:27.145738Z"}]}}