CVE-2025-26137

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26137
Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit this issue to read arbitrary system files by supplying a crafted file path, potentially exposing sensitive information.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Arakiba/CVEs/tree/main/CVE-2025-26137 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:systemic-rm:risk_value:*:*:*:*:*:*:*:*
History

01 Apr 2025, 20:37

Type Values Removed Values Added
References () https://github.com/Arakiba/CVEs/tree/main/CVE-2025-26137 - () https://github.com/Arakiba/CVEs/tree/main/CVE-2025-26137 - Third Party Advisory
CPE cpe:2.3:a:systemic-rm:risk_value:*:*:*:*:*:*:*:*
First Time Systemic-rm
Systemic-rm risk Value

25 Mar 2025, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-98
Summary
  • (es) Systemic Risk Value &lt;=2.8.0 es vulnerable a la inclusión de archivos locales mediante /GetFile.aspx?ReportUrl=. Un atacante no autenticado puede aprovechar este problema para leer archivos de sistema arbitrarios proporcionando una ruta de archivo manipulada, lo que podría exponer información confidencial.

18 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-18 17:15

Updated : 2025-04-01 20:37

NVD link : CVE-2025-26137

Mitre link : CVE-2025-26137

CVE.ORG link : CVE-2025-26137

JSON object : View

Products Affected

systemic-rm

  • risk_value
CWE
CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')