CVE-2026-25575

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25575", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-03T01:02:46.714Z", "datePublished": "2026-02-04T21:54:38.258Z", "dateUpdated": "2026-02-05T17:48:31.956Z"}, "containers": {"cna": {"title": "NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality", "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "lang": "en", "description": "CWE-23: Relative Path Traversal", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-26", "lang": "en", "description": "CWE-26: Path Traversal: '/dir/../filename'", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm"}, {"name": "https://github.com/TUM-Dev/NavigaTUM/pull/2650", "tags": ["x_refsource_MISC"], "url": "https://github.com/TUM-Dev/NavigaTUM/pull/2650"}, {"name": "https://github.com/TUM-Dev/NavigaTUM/commit/86f34c72886a59ec8f1e6c00f78a5ab889a70fd0", "tags": ["x_refsource_MISC"], "url": "https://github.com/TUM-Dev/NavigaTUM/commit/86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"}], "affected": [{"vendor": "TUM-Dev", "product": "NavigaTUM", "versions": [{"version": "< 86f34c72886a59ec8f1e6c00f78a5ab889a70fd0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:54:38.258Z"}, "descriptions": [{"lang": "en", "value": "NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7."}], "source": {"advisory": "GHSA-59hj-f48w-hjfm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T17:48:24.024958Z", "id": "CVE-2026-25575", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T17:48:31.956Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25575", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T17:48:24.024958Z"}}}], "references": [{"url": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T17:48:14.595Z"}}], "cna": {"title": "NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality", "source": {"advisory": "GHSA-59hj-f48w-hjfm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "TUM-Dev", "product": "NavigaTUM", "versions": [{"status": "affected", "version": "< 86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"}]}], "references": [{"url": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm", "name": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TUM-Dev/NavigaTUM/pull/2650", "name": "https://github.com/TUM-Dev/NavigaTUM/pull/2650", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TUM-Dev/NavigaTUM/commit/86f34c72886a59ec8f1e6c00f78a5ab889a70fd0", "name": "https://github.com/TUM-Dev/NavigaTUM/commit/86f34c72886a59ec8f1e6c00f78a5ab889a70fd0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-26", "description": "CWE-26: Path Traversal: '/dir/../filename'"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:54:38.258Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25575", "state": "PUBLISHED", "dateUpdated": "2026-02-05T17:48:31.956Z", "dateReserved": "2026-02-03T01:02:46.714Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T21:54:38.258Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "NavigaTUM", "vendor": "TUM-Dev", "versions": [{"status": "affected", "version": "< 86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tum:navigatum:*:*:*:*:*:*:*:*", "matchCriteriaId": "419E6528-5D2E-451B-9F05-40EC28A72E22", "versionEndExcluding": "2026-02-03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7."}, {"lang": "es", "value": "NavigaTUM es un sitio web y una API para buscar salas, edificios y otros lugares. Antes del commit 86f34c7, existe una vulnerabilidad de salto de ruta en el endpoint propose_edits que permite a usuarios no autenticados sobrescribir archivos en directorios con permisos de escritura para el usuario de la aplicaci\u00f3n (por ejemplo, /cdn). Al proporcionar claves de archivo no saneadas que contienen secuencias de salto (por ejemplo, ../../) en la carga \u00fatil JSON, un atacante puede escapar del directorio temporal previsto y reemplazar im\u00e1genes de cara al p\u00fablico o llenar el almacenamiento del servidor. Este problema ha sido parcheado mediante el commit 86f34c7."}], "id": "CVE-2026-25575", "lastModified": "2026-06-17T10:24:53.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25575", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T17:48:24.024958Z", "version": "2.0.3"}}]}, "published": "2026-02-04T22:16:00.957", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/TUM-Dev/NavigaTUM/commit/86f34c72886a59ec8f1e6c00f78a5ab889a70fd0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/TUM-Dev/NavigaTUM/pull/2650"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/TUM-Dev/NavigaTUM/security/advisories/GHSA-59hj-f48w-hjfm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}, {"lang": "en", "value": "CWE-26"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:08:22.379168+00:00", "value": {"mitigation_remediation": ["Update NavigaTUM to commit 86f34c7 or later, which removes the unsanitized file key processing.", "Immediately disable or restrict access to the propose_edits endpoint for unauthenticated users until the patch can be applied.", "Revoke write permissions for any application\u2011writable directories such as /cdn, ensuring that only legitimate application processes have the necessary access."], "summary": {"action": "Patch Now", "impact": "File Overwrite and Unauthorized Modification"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all versions of TUM-Dev: NavigaTUM released before commit 86f34c7. The affected product is the NavigaTUM website and API, which allows room and place searches. No specific version numbers are listed beyond the commit identifier, indicating that any deployment not updated to or beyond that commit is susceptible.", "description_and_impact": "NavigaTUM contains a path traversal flaw in the propose_edits endpoint that accepts file keys from JSON payloads without sanitization. By including traversal sequences such as \"../../\", an unauthenticated attacker can escape the intended temporary directory and overwrite existing files in directories writable by the application user, such as /cdn. This allows modification of public images or the placement of arbitrary data on the server, potentially leading to site defacement or denial of service via storage exhaustion.", "risk_and_exploitability": "The CVSS score of 8.8 classifies the flaw as high severity, although the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted HTTP request to the propose_edits endpoint; no authentication is needed. Attackers can overwrite arbitrary files in directories with write access, enabling defacement, data corruption, or the placement of malicious files if executable permissions are granted to the target area. The risk remains significant until the patch is applied, but the likelihood of a widespread attack at present is low."}}}}, "created": "2026-02-05T11:39:11.743097+00:00", "updated": "2026-04-17T23:15:30.802530+00:00", "vendors": ["tum-dev", "tum-dev$PRODUCT$navigatum"]}