CVE-2025-27106

🗓️ 21 Feb 2025 21:18:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 80 Views🌐 WEB

Code injection in binance-trading-bot allows Remote Code Execution via `/restore` endpoint vulnerability.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-27106	21 Feb 202522:18	–	circl
CNNVD	Binance Trading Bot 安全漏洞	21 Feb 202500:00	–	cnnvd
Cvelist	CVE-2025-27106 Code injection in binance-trading-bot	21 Feb 202521:18	–	cvelist
EUVD	EUVD-2025-5082	3 Oct 202520:07	–	euvd
Mend	CVE-2025-27106	21 Feb 202521:18	–	mend
NVD	CVE-2025-27106	21 Feb 202522:15	–	nvd
Positive Technologies	PT-2025-7632 · Unknown · Binance-Trading-Bot	21 Feb 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-27106: Improper Neutralization of Special Elements used in an OS Command	21 Feb 202500:00	–	rapid7
RedhatCVE	CVE-2025-27106	23 Feb 202521:22	–	redhatcve
Vulnrichment	CVE-2025-27106 Code injection in binance-trading-bot	21 Feb 202521:18	–	vulnrichment

[
  {
    "vendor": "chrisleekr",
    "product": "binance-trading-bot",
    "versions": [
      {
        "version": "< 0.0.100",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/chrisleekr/binance-trading-bot/blob/dd8e1a91b872a48aec47bbe1280c1c6ea96784d9/app/frontend/webserver/handlers/restore-post.js
github	www.github.com/chrisleekr/binance-trading-bot/commit/99d464cf8ef858d441189993054ec5f5f86e6213
github	www.github.com/chrisleekr/binance-trading-bot/security/advisories/GHSA-wq6j-4388-4gg5

Parameter	Position	Path	Description	CWE
filename	binary	/restore	Remote Code Execution via command injection in /restore endpoint caused by the uploaded file name being passed to shell.exec without proper sanitization beyond path normalization.	CWE-78

17 Jun 2026 09:03Current

7.8High risk

Vulners AI Score7.8

CVSS 47.7

CVSS 3.18.8

EPSS0.02015

SSVC

CWE-78