CVE-2025-63414 — CRITICAL (10.0)

Vulnerability Description

A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute arbitrary commands on the underlying operating system, leading to full remote code execution (RCE).

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Allskyteam	Allsky	2024.12.06_06

Related Weaknesses (CWE)

CWE-22 CWE-78

References

https://gh0stmezh.wordpress.com/2025/12/02/cve-2025-63414/ExploitThird Party Advisory
https://github.com/AllskyTeam/allskyProduct
https://github.com/AllskyTeam/allsky/blob/master/html/execute.phpProduct

FAQ

What is CVE-2025-63414?

CVE-2025-63414 is a vulnerability with a CVSS score of 10.0 (CRITICAL). A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /ht...

How severe is CVE-2025-63414?

CVE-2025-63414 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-63414?

Check the references section above for vendor advisories and patch information. Affected products include: Allskyteam Allsky.