CVE-2025-14311
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jmriboard | jmriboard | 5.13.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Path Traversal issue in JMRI versions before 5.13.3. It allows an attacker to improperly access files and directories outside of the intended restricted directory by manipulating pathname inputs.
How can this vulnerability impact me? :
The vulnerability can allow unauthorized users to access sensitive files or directories that should be restricted, potentially leading to information disclosure or unauthorized modification of files.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by analyzing ZIP files processed by JMRI for path traversal sequences in their entries, such as '../' patterns that attempt to escape the intended extraction directory. You can inspect ZIP files manually or with commands like 'unzip -l <file.zip>' to list contents and look for suspicious paths. Additionally, monitoring file extraction operations for unexpected file writes outside designated directories may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade JMRI to version 5.13.3 or later, where the fix normalizes and validates extracted file paths to prevent path traversal. Until the upgrade, avoid processing untrusted ZIP files with vulnerable versions of JMRI. Implement monitoring to detect unusual file extraction behavior and restrict permissions to limit potential damage from exploitation. [1]