CVE-2025-28367 - mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller

Back Back to CVE browser

MEDIUM

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action

Published Apr 21, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 1.94%

Description

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://github.com/i7MEDIA/mojoportal
Product
https://www.0xlanks.me/blog/cve-2025-28367-advisory/
ExploitPatchThird Party Advisory

Link	Providers	Tags
https://github.com/i7MEDIA/mojoportal		Product
https://www.0xlanks.me/blog/cve-2025-28367-advisory/		ExploitPatchThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 21, 2025

Updated Apr 21, 2025

Reserved Mar 11, 2025

Link CVE-2025-28367

CISA Vulnrichment

Updated Apr 21, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-28367

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-28367