CVE-2025-28367
MEDIUM 6.5EPSS 1.9%
mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
- CVSS v3.1 CNA
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - EPSS
- 1.94% chance of exploitation in the next 30 days, 80th percentile
- Nuclei
- medium · CWE-284
- Published
- 2025-04-21