CVE-2025-69055
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-04-01

Assigner: Patchstack

Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-04-01
Generated
2026-06-16
AI Q&A
2026-01-22
EPSS Evaluated
2026-06-15
NVD
CVE-2025-69055
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack bm_content_builder to 3.16.3.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69055 is a Path Traversal vulnerability in the SeaTheme BM Content Builder WordPress plugin (versions up to 3.16.3). It allows an attacker with at least Contributor or Developer privileges to download arbitrary files from the affected website, including sensitive files such as login credentials or backups. This vulnerability is classified under OWASP Top 10 A5: Broken Access Control and has a moderate severity with a CVSS score of 6.5. [1]

Impact Analysis

This vulnerability can allow attackers with certain privileges to download arbitrary files from your website, potentially exposing sensitive information like login credentials and backups. This can lead to unauthorized access, data breaches, and compromise of your website's security and integrity. [1]

Detection Guidance

Detection of this vulnerability involves monitoring for exploitation attempts targeting the BM Content Builder Plugin, specifically attempts to download arbitrary files by users with Contributor or Developer privileges. Since no official fix is available, applying the Patchstack mitigation rule can help detect and block such attempts. Network or web server logs should be inspected for unusual file download requests or path traversal patterns related to the plugin. Specific commands are not provided in the available resources. [1]

Mitigation Strategies

Immediate mitigation steps include applying the Patchstack mitigation rule provided by Patchstack to block exploitation attempts until an official patch is released. Users should restrict Contributor or Developer privileges carefully and monitor their websites for suspicious activity related to arbitrary file downloads via the BM Content Builder Plugin. Updating the plugin once an official fix is available is also recommended. [1]

Compliance Impact

This vulnerability allows attackers to download arbitrary files, including sensitive files such as those containing login credentials or backups. Such unauthorized access to sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart