CVE-2025-54141: ViewVC's standalone server exposes arbitrary server filesystem content
ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54141?
CVE-2025-54141 is classified as a high severity vulnerability due to its potential to expose sensitive filesystem information.
How do I fix CVE-2025-54141?
To mitigate CVE-2025-54141, upgrade ViewVC to version 1.1.32 or 1.2.4 or later, where the vulnerability has been addressed.
What versions are affected by CVE-2025-54141?
CVE-2025-54141 affects ViewVC versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3.
Can CVE-2025-54141 lead to data breaches?
Yes, CVE-2025-54141 can lead to unauthorized access to the host server's filesystem, which may result in data breaches.
Is CVE-2025-54141 a network-related vulnerability?
CVE-2025-54141 is not strictly network-related; it primarily involves server-side filesystem exposure through the ViewVC application.