CVE-2025-25206

HIGH

8.3

Description

eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.

Details CVE

Score CVSS v3.18.3

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie2/14/2025

Derniere modification8/18/2025

Sourcenvd

Observations honeypot0

Produits affectes

elabftw:elabftw

Faiblesses (CWE)

CWE-89

References

https://github.com/elabftw/elabftw/releases/tag/5.1.15(security-advisories@github.com)

https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg(security-advisories@github.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.