VULNERABILITY INTELLIGENCE
CVE-2025-22152
CVSS score9.1 CRITICAL
EPSS probability0.65%
CISA KEVNot currently listed
Published2025-01-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600.
Weakness classification
- security-advisories@github.com: CWE-22
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94