Description
When uploading organism or sequence data via the web interface,
GMOD Apollo

will unzip and inspect the files and will not check for path
traversal in supported archive types.
Published: 2025-03-04
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

GMOD recommends users to update to the newest Version 2.8.0 https://github.com/GMOD/Apollo .

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-6194 When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.
History

Wed, 05 Mar 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 05 Mar 2025 00:15:00 +0000

Type Values Removed Values Added
Description When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.
Title GMOD Apollo Relative Path Traversal
Weaknesses CWE-23
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-03-05T16:10:26.200Z

Reserved: 2025-02-27T17:04:46.501Z

Link: CVE-2025-23410

cve-icon Vulnrichment

Updated: 2025-03-05T16:10:19.983Z

cve-icon NVD

Status : Received

Published: 2025-03-05T00:15:38.250

Modified: 2025-03-05T00:15:38.250

Link: CVE-2025-23410

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses