CVE-2025-1743
published 2025-02-27CVE-2025-1743: A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The…
PriorityP279medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.62%
73.1th percentile
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyx0814 | pichome | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
regex: root:.*:0:0:
- →Detect exploitation attempts by monitoring GET requests to /index.php with mod=textviewer and a src parameter containing file:// URI scheme or path traversal sequences. ↗
- →A successful exploit response will contain both the passwd file content matching 'root:.*:0:0:' and the string '.scrollbar__wrap' in the HTTP 200 response body. ↗
- →Use Shodan or FOFA to identify exposed Pichome instances as potential targets: Shodan query 'title:"PicHome"', FOFA query 'title="PicHome"'. ↗
- →The attack requires no authentication (PR:N, UI:N per CVSS), so any unauthenticated GET request to the textviewer endpoint with a file:// src parameter should be treated as malicious. ↗
- ·The vulnerability affects specifically Pichome version 2.1.0; the CPE scope is limited to this version. ↗
- ·The exploit proof-of-concept targets /etc/passwd (Linux); detection rules using this file path may not apply to Windows-hosted Pichome instances. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v53m-h2x7-3m5p: A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2
ghsa_unreviewed·2025-02-27
CVE-2025-1743 [MEDIUM] CWE-22 GHSA-v53m-h2x7-3m5p: A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
VulnCheck
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2025·CVSS 6.9
CVE-2025-1743 [MEDIUM] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected: zyx0814 Pichome
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://tracker.crowdsec.net/cves/CVE-2025-1743
No detection rules found.
Nuclei
Pichome 2.1.0 - Arbitrary File Read
nuclei·CVSS 6.9
CVE-2025-1743 [MEDIUM] Pichome 2.1.0 - Arbitrary File Read
Pichome 2.1.0 - Arbitrary File Read
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Template:
id: CVE-2025-1743
info:
name: Pichome 2.1.0 - Arbitrary File Read
author: 3th1c_yuk1
severity: high
description: |
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi
2025-02-27
Published
Exploited in the wild