CVE-2025-2305 — Local file inclusion vulnerability in LIVE CONTRACT

CVE-2025-2305

Local file inclusion vulnerability in LIVE CONTRACT PUBLISHED

Description (CNA)

A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server.

Affected (CNA)

Vendor / product	Versions
SYNCPILOT / LIVE CONTRACT	affected 3 before 5.4.12; affected 5.5 before 5.5.4; affected 5.6 before 5.6.3

CWE

CWE-20

References

https://www.cirosec.de/sa/sa-2025-003

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.