{"id":"CVE-2025-63414","aliases":["EUVD-2025-203804","GHSA-8259-wq47-7hr3"],"status":"published","title":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an...","description":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.01846,"percentile":0.79371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-78"],"published":"2025-12-16T00:00:00Z","modified":"2026-10-28T02:30:44Z","products":[{"vendor":"allskyteam","product":"allsky"}],"references":[{"url":"https://github.com/AllskyTeam/allsky","tags":["Product","package"]},{"url":"https://github.com/AllskyTeam/allsky/blob/master/html/execute.php","tags":["Product","web"]},{"url":"https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414/","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63414","tags":["advisory"]},{"url":"https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414"},{"url":"https://github.com/advisories/GHSA-8259-wq47-7hr3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63414.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-63414","description":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).","status":"published","published":"2025-12-16T00:00:00Z","modified":"2025-12-16T16:47:23.031Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22","CWE-78"],"updated_at":"2026-11-02T14:32:45.797843Z"}],"euvd":[{"id":"EUVD-2025-203804","description":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).","status":"published","published":"2025-12-16T00:00:00Z","modified":"2025-12-16T16:47:23Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:05.078672Z"}],"ghsa":[{"id":"GHSA-8259-wq47-7hr3","title":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an...","description":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).","status":"published","published":"2025-12-16T18:31:35Z","modified":"2025-12-16T18:31:42Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:05:13.507882Z"}],"nvd":[{"id":"CVE-2025-63414","description":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).","status":"published","published":"2025-12-16T17:16:10.473Z","modified":"2026-06-17T09:53:06.037Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22","CWE-78"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-63414","description":"A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).","status":"published","published":"2025-12-16T00:00:00Z","modified":"2026-10-28T02:30:44.391972731Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:51.851511Z"}]}}