CVE-2025-11031

DataTables examples.php path traversal

State: Published
Severity: 6.9 Medium
Published: Sep 26, 2025
Updated: Sep 26, 2025
Reserved: Sep 26, 2025

Description

A flaw has been found in DataTables up to 1.10.13. The affected element is an unknown function of the file /examples/resources/examples.php. This manipulation of the argument src causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.10.15 is sufficient to fix this issue. Patch name: 3b24f99ac4ddb7f9072076b0d07f0b1a408f177a. Upgrading the affected component is advised. This vulnerability was initially reported for code-projects Faculty Management System but appears to affect DataTables as an upstream component instead. The vendor of DataTables explains: "I would suggest that the author upgrade to the latest versions of DataTables (actually, they shouldn't really be deploying that file to their own server at all - it is only relevant for the DataTables examples)."

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
DataTablesn/a	1.10.0Affected 1.10.1Affected 1.10.2Affected 1.10.3Affected 1.10.4Affected 1.10.5Affected 1.10.6Affected 1.10.7Affected 1.10.8Affected 1.10.9Affected 1.10.10Affected 1.10.11Affected 1.10.12Affected 1.10.13Affected 1.10.15Not affected

References

VDB-325970 | DataTables examples.php path traversalvdb-entrytechnical-description
VDB-325970 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #657918 | code-projects Faculty Management System 1.0 Path Traversal: '.../...//'third-party-advisory
https://github.com/xiaoliyu-1/Faculty-Management-System-examples.php-v.1.0-Path-Traversal/blob/main/report.mdrelated
https://github.com/xiaoliyu-1/Faculty-Management-System-examples.php-v.1.0-Path-Traversal/blob/main/report.md#urlexploit
https://github.com/DataTables/DataTables/commit/3b24f99ac4ddb7f9072076b0d07f0b1a408f177apatch
https://github.com/DataTables/DataTables/releases/tag/1.10.15patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.