CVE-2025-67810
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-02-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| area9lyceum | rhapsode | 1.47.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67810 is a vulnerability in Area9 Rhapsode version 1.47.3 and earlier, where an authenticated attacker can exploit the 'operation,' 'url,' and 'filename' parameters via a POST request to read arbitrary files from the server's filesystem. This means the attacker can access files they should not be able to, potentially exposing sensitive data stored on the server. The issue was fixed in version 1.47.4. [1]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to read arbitrary files on the server, which could lead to unauthorized exposure of sensitive or confidential information stored on the server. This could compromise data privacy and security, potentially affecting the integrity of the system and the confidentiality of user or organizational data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for POST requests that include the parameters "operation", "url", and "filename" attempting to read arbitrary files from the server filesystem. You can use network monitoring tools or web server logs to identify suspicious POST requests containing these parameters. For example, using curl to test the vulnerability: curl -X POST -d "operation=someOperation&url=someUrl&filename=/etc/passwd" https://yourserver/path. Additionally, inspecting web server logs for unusual POST requests with these parameters may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Area9 Rhapsode to version 1.47.4 or later, where the issue has been fixed (commit #7254). Until the upgrade can be applied, restrict authenticated user access to the affected endpoints and monitor for suspicious POST requests with the "operation", "url", and "filename" parameters to prevent exploitation. [1]