CVE-2025-7626
published 2025-07-14CVE-2025-7626: A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.53%
40.7th percentile
A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| git | git | >= 0 < 1:2.34.1-1ubuntu1.14 | 1:2.34.1-1ubuntu1.14 |
| git | git | >= 0 < 1:2.34.1-1ubuntu1.15 | 1:2.34.1-1ubuntu1.15 |
| git | git | >= 0 < 1:2.7.4-0ubuntu1.10+esm10 | 1:2.7.4-0ubuntu1.10+esm10 |
| git | git | >= 0 < 1:2.7.4-0ubuntu1.10+esm11 | 1:2.7.4-0ubuntu1.10+esm11 |
| git | git | >= 0 < 1:2.17.1-1ubuntu0.18+esm3 | 1:2.17.1-1ubuntu0.18+esm3 |
| git | git | >= 0 < 1:2.17.1-1ubuntu0.18+esm4 | 1:2.17.1-1ubuntu0.18+esm4 |
| git | git | >= 0 < 1:2.25.1-1ubuntu3.14+esm2 | 1:2.25.1-1ubuntu3.14+esm2 |
| git | git | >= 0 < 1:2.25.1-1ubuntu3.14+esm3 | 1:2.25.1-1ubuntu3.14+esm3 |
| yijiusmile | kkfileviewofficeedit | <= 2019-03-19 | — |
| yijiusmile | kkfileviewofficeedit | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv3.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pq6v-r7gf-6cww: A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical
ghsa_unreviewed·2025-07-14
CVE-2025-7626 [MEDIUM] CWE-22 GHSA-pq6v-r7gf-6cww: A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical
A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
OSV
git regression
osv·2025-07-10·CVSS 3.6
CVE-2025-27613 git regression
git regression
USN-7626-1 fixed vulnerabilities in Git. The updates for CVE-2025-27613
and CVE-2025-46835 caused Gitk and Git GUI to not work properly on Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and
were disabled in USN-7626-2. The problematic updates for the
aforementioned CVEs have now been corrected and reinstated in this update.
We apologize for the inconvenience.
Original advisory details:
Avi Halachmi discovered that Git incorrectly managed file modification
constraints with Gitk. An attacker could possibly use this issue to create
or write to arbitrary files on the system. (CVE-2025-27613)
Avi Halachmi discovered that Git incorrectly handled arguments when
invoking the Gitk utility. If a user were tricked into cloning a malicious
Git repositor
OSV
git regression
osv·2025-07-09·CVSS 3.6
CVE-2025-27613 git regression
git regression
USN-7626-1 fixed vulnerabilities in Git. The update introduced a regression
in gitk and git-gui. This update reverts the corresponding fixes for
CVE-2025-27613 and CVE-2025-46835 pending further investigation.
We apologize for the inconvenience.
Original advisory details:
Avi Halachmi discovered that Git incorrectly managed file modification
constraints with Gitk. An attacker could possibly use this issue to create
or write to arbitrary files on the system. (CVE-2025-27613)
Avi Halachmi discovered that Git incorrectly handled arguments when
invoking the Gitk utility. If a user were tricked into cloning a malicious
Git repository, an attacker could possibly use this issue to run arbitrary
commands. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and
Ubuntu 25.04
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-14
Published