Back to Database
Status published
Critical
CVE-2025-47788
Missing Path Validation Enables Path Traversal in Controller.php
Vulnerability Description
Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was not properly validated, which could allow an attacker to execute arbitrary files on the server via path traversal. v602 contains a fix for the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47788
Credits & Attribution
No credits recorded in the NVD database.
References
Affected Vendor
Atheos
View all reports →Affected Software
Atheos
Vulnerable Versions:
< 602
Timeline
Official Publish:
May 15th, 2025
Last Modified:
May 19th, 2025
Added to House:
July 22nd, 2026