by Kastro
Paper/Archive/CVE-2025-23410

CVE-2025-23410

GMOD Apollo — GMOD Apollo Relative Path Traversal

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.6.516 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.

Affected

ProductAffectedFixed inSource
Apollo< 2.8.02.8.0CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-063-07