CVE-2025-7115 is a critical missing authentication vulnerability in the rowboatlabs rowboat application, specifically within the Session Handler component's PUT function in apps/rowboat/app/api/uploads/[fileId]/route.ts. This flaw allows remote attackers to bypass authentication by manipulating the 'params' argument, affecting all versions up to commit 8096eaf63b5a0732edd8f812bee05b78e214ee97. Rated with a CVSS score of 7.3 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, potentially leading to low impacts on confidentiality, integrity, and availability. The FAUCET Risk Score is 71/100, indicating a significant risk. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or community discussion has been identified. Due to the product's continuous delivery model, specific affected or patched versions are unavailable, though a fix is anticipated soon.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Rowboatlabs | Rowboat | 8096eaf63b5a0732edd8f812bee05b78e214ee97CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.