CVE-2025-41073 — Path Traversal in Gandia Integra Total by TESI

CVE-2025-41073

Path Traversal in Gandia Integra Total by TESI PUBLISHED

Description (CNA)

Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated attacker to download a ZIP file containing files from the server, including those located in parent directories (e.g., ..\..\..), by exploiting the “direstudio” parameter in “/encuestas/integraweb[_v4]/integra/html/view/comprimir.php”.

Affected (CNA)

Vendor / product	Versions
TESI / Gandia Integra Total	affected 0 before 4.4.2246.2

CWE

CWE-22

References

https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-gandia-integra-total-tesi

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.