CVE-2025-28367

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cve@mitre.org

Published

2025-04-21

Last modified

2025-04-21

Weaknesses

CWE-284

Affected products

• Mojoportal (Mojoportal)

References

• https://github.com/i7MEDIA/mojoportal
• https://www.0xlanks.me/blog/cve-2025-28367-advisory/