Description
Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of system files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Symfonia | Ready_ | 7.0.0.0 – ≤ 7.19.39.23, 8.0.0.0 – ≤ 8.0.2.3 | — |
References
- https://cert.pl/posts/2025/04/CVE-2025-1980 third-party-advisory
- https://cert.pl/en/posts/2025/04/CVE-2025-1980 third-party-advisory
- https://ready-os.com/pl/ product