Fedorarepository maintains fcrepo, a digital repository platform for managing and preserving institutional content, with a narrow vulnerability footprint centered on access-control and path-handling weaknesses. The recurring signal points to relative path traversal and default credential issues, attack surfaces characteristic of web-facing repository systems where authentication and input normalization are foundational to security.
The number and severity of CVEs published that impact products developed by Fedorarepository over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-23011HIGH Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extr | Jan 23, 2025 | 8.8 | 25 | NO | NO |
CVE-2025-23012HIGH Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Reposito | Jan 23, 2025 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fedorarepository.
Media articles that mention a CVE ID that affects a product developed by Fedorarepository — matched by CVE ID, not by vendor name.