Threats affecting pkg:github/csprousers/csweb

CVE-2025-60949 is a critical vulnerability in Census CSWeb version 8.0.1 that allows unauthenticated remote attackers to access sensitive configuration files via HTTP. The vulnerability arises because the "app/config" directory is accessible without authentication in some deployments, leading to exposure of secrets such as credentials or keys. This flaw does not require user interaction or privileges and has a CVSS 4.0 score of 9.3, indicating high impact on confidentiality and integrity. The issue is fixed in version 8.1.0 alpha.

CVE-2025-60947 is a high-severity vulnerability in Census CSWeb version 8.0.1 that allows authenticated remote attackers to upload arbitrary files without proper restrictions. This unrestricted file upload flaw (CWE-434) can lead to remote code execution, compromising confidentiality, integrity, and availability of affected systems. The vulnerability requires authentication but no user interaction beyond that. It has a CVSS score of 8.8, indicating a critical impact if exploited. The issue is fixed in version 8.1.0 alpha.

CVE-2025-60946 is a high-severity path traversal vulnerability in Census CSWeb version 8.0.1 that allows a remote authenticated attacker to access arbitrary files outside the intended directory. Exploitation requires authentication but no user interaction, and it can lead to full confidentiality, integrity, and availability compromise. The vulnerability arises from improper limitation of pathname input (CWE-22), enabling attackers to traverse directories and access sensitive files. The issue is fixed in version 8.1.0 alpha. While no known exploits are currently reported in the wild, the high CVSS score (8.8) indicates significant risk.