Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🚨 HIGH severity CVE-2025-66905 (CVSS 7.5) Takes web framework TkFiles (≤2.0-SNAPSHOT) vulnerable to path traversal. Remote attackers can read arbitrary files via ../ sequences. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/UraiQ0Evfs
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | takes | tkfiles | 2.0 | - | - |