CVE-2025-15066

Arbitrary File Download through Path Traversal in Innorix WP

State: Published
Severity: 6.9 Medium
Published: Dec 29, 2025
Updated: Dec 29, 2025
Reserved: Dec 24, 2025

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This issue affects Innorix WP from All versions If the "exam" directory exists under the directory where the product is installed (ex: innorix/exam)

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	FSI
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	FSI

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-862 Missing Authorization

Affected Products

Product	Versions
Innorix WPInnorix	all versionsUnknown

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.