CVE-2025-10438 - Vulnerability Details - OpenCVE

Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.This issue affects Yordam Katalog: before 21.7.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00057.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-25-0296

History

Thu, 25 Sep 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 25 Sep 2025 11:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}`	cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}`

Thu, 25 Sep 2025 09:30:00 +0000

Type	Values Removed	Values Added
Description		Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.This issue affects Yordam Katalog: before 21.7.
Title		Path Traversal in Yordam BT's Yordam Katalog
Weaknesses		CWE-27
References		https://www.usom.gov.tr/bildirim/tr-25-0296
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2025-09-25T09:18:44.444Z

Updated: 2025-09-25T14:33:40.806Z

Reserved: 2025-09-14T15:09:45.475Z

Link: CVE-2025-10438

Vulnrichment

Updated: 2025-09-25T13:36:30.488Z

NVD

Status : Awaiting Analysis

Published: 2025-09-25T10:15:29.397

Modified: 2025-09-26T14:32:53.583

Link: CVE-2025-10438

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-10438", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-09-14T15:09:45.475Z", "datePublished": "2025-09-25T09:18:44.444Z", "dateUpdated": "2025-09-25T14:33:40.806Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Yordam Katalog", "vendor": "Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc.", "versions": [{"lessThan": "21.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Sarp Dora Y\u00f6nden"}, {"lang": "en", "type": "finder", "value": "Muhammet Talha Odaba\u015f\u0131"}, {"lang": "en", "type": "coordinator", "value": "Abdurrahman Emre \u00d6zk\u00f6k"}], "datePublic": "2025-09-25T09:13:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.<p>This issue affects Yordam Katalog: before 21.7.</p>"}], "value": "Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.This issue affects Yordam Katalog: before 21.7."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-27", "description": "CWE-27 Path Traversal: 'dir/../../filename'", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2025-09-25T14:33:40.806Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0296"}], "source": {"advisory": "TR-25-0296", "defect": ["TR-25-0296"], "discovery": "UNKNOWN"}, "title": "Path Traversal in Yordam BT's Yordam Katalog", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-25T13:32:25.849959Z", "id": "CVE-2025-10438", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-25T13:36:41.811Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-25T13:32:25.849959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-25T13:36:30.488Z"}}], "cna": {"title": "Path Traversal in Yordam BT's Yordam Katalog", "source": {"defect": ["TR-25-0296"], "advisory": "TR-25-0296", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Sarp Dora Y\u00f6nden"}, {"lang": "en", "type": "finder", "value": "Muhammet Talha Odaba\u015f\u0131"}, {"lang": "en", "type": "coordinator", "value": "Abdurrahman Emre \u00d6zk\u00f6k"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc.", "product": "Yordam Katalog", "versions": [{"status": "affected", "version": "0", "lessThan": "21.7", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-09-25T09:13:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0296"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.This issue affects Yordam Katalog: before 21.7.", "supportingMedia": [{"type": "text/html", "value": "Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.<p>This issue affects Yordam Katalog: before 21.7.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-27", "description": "CWE-27 Path Traversal: 'dir/../../filename'"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2025-09-25T14:33:40.806Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10438", "state": "PUBLISHED", "dateUpdated": "2025-09-25T14:33:40.806Z", "dateReserved": "2025-09-14T15:09:45.475Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-09-25T09:18:44.444Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}