CVE-2023-25814

Arbitrary File Read Vulnerability in metersphere

State: Published
Severity: 7.1 High
Published: Mar 9, 2023
Updated: Feb 25, 2025
Reserved: Feb 15, 2023

Description

metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
meterspheremetersphere	< 2.7.1Affected

References

https://github.com/metersphere/metersphere/security/advisories/GHSA-fwc3-5h55-mh2j

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.