CVE-2025-60949 - CVE House

Status published Critical CVE-2025-60949

Census CSWeb leaked configuration files

9.3 CVSS

Vulnerability Description

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-60949

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Census

View All →

CVE-2025-60948

Census CSWeb stored XSS

Medium 5.1

CVE-2025-60947

Census CSWeb arbitrary file upload

High 8.7

CVE-2025-60946

Census CSWeb path traversal

High 8.7

Affected Vendor

Census

View all reports →

Affected Software

CSWeb

Vulnerable Versions:

8.0.1, 8.1.0 alpha

Timeline

Official Publish: March 23rd, 2026

Last Modified: March 25th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

Collection

T1005 Data from Local System