Critical · 9.8 CVE-2025-57266 EUVD-2025-31634GHSA-cj24-xhqv-5896

An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers …

Published Sep 29, 2025 · Updated Sep 29, 2025 · Assigned by mitre

Description

An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the /api/assistant/list endpoint.

References

https://github.com/LiuYuYang01/ThriveX-Server/issues/55
https://gist.github.com/candyb0x/fccc49a989473b7f1e47479619eaf1ca