CVE-2025-7115

rowboatlabs rowboat Session route.ts PUT missing authentication

State: Published
Severity: 6.9 Medium
Published: Jul 7, 2025
Updated: Jul 7, 2025
Reserved: Jul 6, 2025

Description

A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C	VulDB

Weaknesses

CWE-306 Missing Authentication
CWE-287 Improper Authentication

Affected Products

Product	Versions
rowboatrowboatlabs	8096eaf63b5a0732edd8f812bee05b78e214ee97Affected

References

VDB-315026 | rowboatlabs rowboat Session route.ts PUT missing authenticationvdb-entrytechnical-description
VDB-315026 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #604899 | Rowboat Labs RowBoat git checkout 8096eaf63b5a0732edd8f812bee05b78e214ee97 Unauthorized file uploadthird-party-advisory
https://github.com/rowboatlabs/rowboat/issues/166issue-tracking
https://github.com/rowboatlabs/rowboat/issues/166#issuecomment-2995195594issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.