CVE-2025-57266: Critical severity ThriveX Blogging Framework vulnerability
An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the /api/assistant/list endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57266?
CVE-2025-57266 is classified as a medium severity vulnerability due to the potential exposure of sensitive information.
How can I mitigate the effects of CVE-2025-57266?
To mitigate CVE-2025-57266, restrict access to the /api/assistant/list endpoint and ensure proper authentication mechanisms are in place.
Which versions of ThriveX Blogging Framework are affected by CVE-2025-57266?
CVE-2025-57266 affects versions 2.5.9 through 3.1.3 of the ThriveX Blogging Framework.
What kind of sensitive information can be exposed by CVE-2025-57266?
CVE-2025-57266 can lead to the exposure of sensitive information such as API Keys.
Is there a fix available for CVE-2025-57266?
A fix for CVE-2025-57266 involves updating to a patched version of ThriveX Blogging Framework that addresses this vulnerability.