CVE-2025-55988

Published: Mar 20, 2026 Last Modified: Mar 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.

https://github.com/dreamfactorysoftware/df-core/commit/5435…
https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756…
https://pentest-tools.com/PTT-2025-001-RemoteCodeExecution-…
https://pentest-tools.com/PTT-2025-001-RemoteCodeExecution-via-URL-Path-Travers…