CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.53% chance of exploitation in the next 30 days, 43th percentile

Published

2025-05-13

Updated

2025-05-14

Proof-of-concept exploits (1)

• shinnku-nikaidou/upset-gal-web/issues/132

References

• CVE Record
• NVD entry

Related

• CVE-2025-28039
• CVE-2025-28056
• CVE-2025-28038
• CVE-2025-28057
• CVE-2025-28037
• CVE-2025-28062