CVE-2025-2917

CVE-2025-2917 is a high-severity path traversal vulnerability affecting ChestnutCMS versions up to 1.5.3, specifically within the readFile function of the /dev-api/cms/file/read endpoint. This flaw allows an unauthenticated attacker to remotely manipulate the filePath argument, potentially leading to unauthorized access to sensitive files on the server. With a CVSS score of 7.5 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high confidentiality impact. While the exploit has been publicly disclosed, there are currently no known Metasploit or Nuclei modules, nor is it listed on ExploitDB. Despite public disclosure, there is no evidence of active exploitation, and community discussion and media coverage remain minimal, indicating low current attention.