CVE-2025-69601

A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically extracted without validating or sanitizing file paths. An attacker can include traversal sequences (e.g., ../) in ZIP entries to write files outside the intended extraction directory. This allows static files (html, js, css, images) file write to unintended locations, or overwriting existing HTML files, potentially leading to content defacement and, in certain deployments, further impact if sensitive files are overwritten.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Waqar-Arain/9cd59aa74de540eeb3b09d15bac35e36	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:altumcode:66biolinks:44.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-28 19:16

Updated : 2026-06-17 10:00

NVD link : CVE-2025-69601

Mitre link : CVE-2025-69601

CVE.ORG link : CVE-2025-69601

JSON object : View

Products Affected

altumcode

66biolinks

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-69601", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69601", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T18:37:27.632484Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-28T19:16:23.910", "references": [{"url": "https://gist.github.com/Waqar-Arain/9cd59aa74de540eeb3b09d15bac35e36", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A directory traversal (Zip Slip) vulnerability exists in the \u201cStatic Sites\u201d feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically extracted without validating or sanitizing file paths. An attacker can include traversal sequences (e.g., ../) in ZIP entries to write files outside the intended extraction directory. This allows static files (html, js, css, images) file write to unintended locations, or overwriting existing HTML files, potentially leading to content defacement and, in certain deployments, further impact if sensitive files are overwritten."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio (Zip Slip) existe en la caracter\u00edstica 'Sitios Est\u00e1ticos' de 66biolinks v44.0.0 de AltumCode. Los archivos ZIP subidos se extraen autom\u00e1ticamente sin validar ni sanear las rutas de archivo. Un atacante puede incluir secuencias de salto (p. ej., ../) en las entradas ZIP para escribir archivos fuera del directorio de extracci\u00f3n previsto. Esto permite la escritura de archivos est\u00e1ticos (html, js, css, im\u00e1genes) en ubicaciones no deseadas, o la sobrescritura de archivos HTML existentes, lo que podr\u00eda llevar a la desfiguraci\u00f3n del contenido y, en ciertas implementaciones, a un mayor impacto si se sobrescriben archivos sensibles."}], "lastModified": "2026-06-17T10:00:45.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altumcode:66biolinks:44.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00EE5075-C301-4499-9115-A0CA3D87AFD7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}