Description
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions.
Medium · 6.5
CVE-2025-67810
EUVD-2026-1683GHSA-7r2g-px2q-wrcx
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitr…
Published Jan 9, 2026 · Updated Jan 9, 2026 · Assigned by mitre