CVE-2025-54118
BaseFortify
Publication date: 2025-08-18
Last updated on: 2025-08-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| namelessmc | nameless | to 2.2.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-54118 is a vulnerability in NamelessMC versions before 2.2.4 where an unauthenticated remote attacker can exploit improper error handling in the member list component by sending a specially crafted HTTP GET request with the 'list' parameter. This triggers an application error that discloses sensitive information such as the absolute file system path of the source code, which can help attackers in further exploitation. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by exposing sensitive server information, specifically the absolute path of the source code, to unauthenticated remote attackers. This information disclosure can aid attackers in planning further attacks against your system, potentially increasing the risk of more severe security breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP GET request to the vulnerable endpoint and observing if sensitive information such as absolute file paths is disclosed in the error response. For example, you can use the following curl command to test for the vulnerability: curl -i "http://<target>/nameless/queries/member_list/?list=&page=1&overview=false" and check if the response contains file paths or error messages revealing source code locations. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade NamelessMC to version 2.2.4 or later, where this vulnerability is fixed. Until the upgrade can be performed, you may consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to block requests containing suspicious parameters targeting /nameless/queries/member_list/. [1]