CVE-2025-23410

critical · 9.3

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.

9.3

CVSS

0.6%

EPSS (exploit prob.)

50th

EPSS percentile

2025-03-05

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-23

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-23410