CVE-2025-11941

🗓️ 19 Oct 2025 15:32:10Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 6 Views🌐 WEB

CVE-2025-11941: e107 CMS up to 2.3.3 permits remote path traversal via avatar handler image.php multiaction[].

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2025-11941	19 Oct 202516:50	–	circl
CNNVD	e107 路径遍历漏洞	19 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-11941 e107 CMS Avatar image.php path traversal	19 Oct 202515:32	–	cvelist
EUVD	EUVD-2025-35005	19 Oct 202518:30	–	euvd
NVD	CVE-2025-11941	19 Oct 202516:15	–	nvd
RedhatCVE	CVE-2025-11941	20 Oct 202519:28	–	redhatcve
Vulnrichment	CVE-2025-11941 e107 CMS Avatar image.php path traversal	19 Oct 202515:32	–	vulnrichment

NVD

Vulners

Node

e107 e107Range≤2.3.3

[
  {
    "vendor": "e107",
    "product": "CMS",
    "versions": [
      {
        "version": "2.3.0",
        "status": "affected"
      },
      {
        "version": "2.3.1",
        "status": "affected"
      },
      {
        "version": "2.3.2",
        "status": "affected"
      },
      {
        "version": "2.3.3",
        "status": "affected"
      }
    ],
    "modules": [
      "Avatar Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
note-hxlab	www.note-hxlab.wetolink.com/share/igdVbDCk2IkD
note-hxlab	www.note-hxlab.wetolink.com/share/igdVbDCk2IkD

Parameter	Position	Path	Description	CWE
multiaction[]	request body	/e107_admin/image.php?mode=main&action=avatar	Path traversal via manipulation of multiaction[] in image.php avatar handler	CWE-22

29 Apr 2026 01:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.4 - 8.1

CVSS 45.3

CVSS 25.5

CVSS 35.4

EPSS0.00121

SSVC

CWE-22