CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

com.baudoliver7:takes-utils (>=0.2, <=0.3.3), com.buschmais.jqassistant.cli:application (>=2.6.0-rc1, <=2.10.0-m2) +63 more potentially affected by CVE-2025-66905 via org.takes:takes (>=0.16.7, <=1.26.0)

org.takes:takes MAVEN version =0.16.7, =0.2, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.7.0-rc1, =2.10.0-m2 and more Source cves: CVE-2025-66905 Source advisory:...

CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

CVE-2025-66905

The CVE-2025-66905 entry concerns the Takes web framework, specifically the TkFiles component up to 2.0-SNAPSHOT, which fails to canonicalize HTTP request paths before filesystem access. This allows a remote attacker to include ../ sequences in the request path to escape the configured base direc...