HOME VULNERABILITIESCVE-2025-48382

MEDIUM

CVE-2025-48382

CWE-732Published: May 27, 2025· Updated: Jun 17, 2026

5.5

CVSS v3.1

Official Description

Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact. This issue has been patched in version 14.19.2. A workaround for this issue involves ensuring local access to the environment running Fess is restricted to trusted users only.

Technical Analysis

CVE-2025-48382 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

codelibs1 product(s)

fess

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4

ADVISORYhttps://github.com/codelibs/fess/security/advisories/GHSA-g88v-2j67-9rmx

All References (2)

→

https://github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4Patch

→

https://github.com/codelibs/fess/security/advisories/GHSA-g88v-2j67-9rmxThird Party Advisory

Quick Facts

CVE IDCVE-2025-48382

CVSS Score5.5 / 10

SeverityMEDIUM

WeaknessCWE-732

CISA KEVNo

Affected1 vendor(s)

PublishedMay 27, 2025

Related CVEs (CWE-732)

CVE-2014-125121

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2025-48382 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2025-48382·NVD