{"id":"CVE-2025-69618","aliases":["EUVD-2025-206818","GHSA-xrh7-29mh-fp98"],"status":"published","title":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing...","description":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00401,"percentile":0.34852,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-434"],"published":"2026-02-04T00:00:00Z","modified":"2026-07-05T02:17:36Z","products":[{"vendor":"coto.world","product":"coto"}],"references":[{"url":"https://secsys.fudan.edu.cn/","tags":["Not Applicable"]},{"url":"https://coto.world/","tags":["Product"]},{"url":"https://github.com/Secsys-FDU/AF_CVEs/issues/9","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69618"},{"url":"https://coto.world"},{"url":"https://secsys.fudan.edu.cn"},{"url":"http://coto.com"},{"url":"https://github.com/advisories/GHSA-xrh7-29mh-fp98"}],"sources":{"cve":[{"id":"CVE-2025-69618","description":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.","status":"published","published":"2026-02-04T00:00:00Z","modified":"2026-07-05T01:28:29.27Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-206818","description":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.","status":"published","published":"2026-02-04T00:00:00Z","modified":"2026-07-05T01:28:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:14.793418Z"}],"ghsa":[{"id":"GHSA-xrh7-29mh-fp98","title":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing...","description":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.","status":"published","published":"2026-02-04T15:30:29Z","modified":"2026-03-13T21:32:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-22","CWE-434"],"updated_at":"2026-11-02T15:06:36.943588Z"}],"nvd":[{"id":"CVE-2025-69618","description":"An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro \u0026 Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.","status":"published","published":"2026-02-04T15:16:13.047Z","modified":"2026-07-05T02:17:36.313Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:59.832225Z"}]}}