CVE-2025-67810

In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cve@mitre.org

Published

2026-01-09

Last modified

2026-01-09

Weaknesses

CWE-125

Affected products

• Rhapsode (Area9lyceum)

References

• https://area9.com
• https://security.area9lyceum.com/cve-2025-67810/