CVE-2025-66955

Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/TheWoodenBench/CVE-2025-66955	Third Party Advisory
https://live.asee.io/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:asseco:live:2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-12 19:16

Updated : 2026-07-05 02:17

NVD link : CVE-2025-66955

Mitre link : CVE-2025-66955

CVE.ORG link : CVE-2025-66955

JSON object : View

Products Affected

asseco

live

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2025-66955", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66955", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-14T03:31:56.868610Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-12T19:16:15.077", "references": [{"url": "https://github.com/TheWoodenBench/CVE-2025-66955", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://live.asee.io/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via \"path\" parameter in the downloadAttachment and downloadAttachmentFromPath API calls."}, {"lang": "es", "value": "Inclusi\u00f3n local de ficheros en los componentes Contact Plan, E-Mail, SMS y Fax en Asseco SEE Live 2.0 permite a usuarios autenticados remotos acceder a ficheros en el host a trav\u00e9s del par\u00e1metro 'path' en las llamadas a la API downloadAttachment y downloadAttachmentFromPath."}], "lastModified": "2026-07-05T02:17:31.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asseco:live:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F87F713C-E2CE-4E9F-A5BC-E0F130BF5F2F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}