CVE-2025-13282 is an Arbitrary File Delete vulnerability affecting Chunghwa Telecom's TenderDocTransfer application. It stems from a lack of CSRF protection in the application's local web server APIs, combined with an Absolute Path Traversal flaw in one of these APIs. This allows unauthenticated remote attackers, via phishing, to delete arbitrary files on a user's system. The vulnerability carries a high severity CVSS score of 8.1, indicating a critical risk. It has a low attack complexity and requires user interaction (UI:R), but successful exploitation leads to high impact on integrity and availability (I:H/A:H). Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also minimal, suggesting low awareness of this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.41.159CPE matchmatch criteria | cpe:2.3:a:cht:tenderdoctransfer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.