CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

com.baudoliver7:takes-utils (>=0.2, <=0.3.3), com.buschmais.jqassistant.cli:application (>=2.6.0-rc1, <=2.10.0-m4) +64 more potentially affected by CVE-2025-66905 via org.takes:takes (>=0.16.7, <=1.26.0)

org.takes:takes MAVEN version =0.16.7, =0.2, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.7.0-rc1, =2.10.0-m4 and more Source cves: CVE-2025-66905 Source advisory:...

CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

CVE-2025-66905

The Takes web framework (versions through 2.0-SNAPSHOT ) is vulnerable to a Directory Traversal (CWE-22) flaw within the TkFiles component. The root cause is a failure to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can use ../ sequences or URL-e...