Skip to content
OpenAdvisories
High · 7.2 CVE-2025-55988 EUVD-2025-208913GHSA-gv7f-w92j-383q

DreamFactory has a directory traversal

Published Mar 20, 2026 · Updated Mar 23, 2026 · Assigned by mitre

Description

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist dreamfactory/df-core < 1.0.4 1.0.4 GHSA-gv7f-w92j-383q

References