ByteOS Network

NVD Vulnerability Details :

CVE-2025-67174

Analyzed

Source-cve@mitre.org

Published At-17 Dec, 2025 | 19:16

Updated At-18 Dec, 2025 | 19:19

A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 6.2

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

ritecms>>ritecms>>3.1.0

cpe:2.3:a:ritecms:ritecms:3.1.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	nvd@nist.gov
CWE-22	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-22

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-22

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://github.com/handylulu/RiteCMS	cve@mitre.org	Product
https://github.com/handylulu/RiteCMS/blob/master/admin.php#L46	cve@mitre.org	Product
https://github.com/handylulu/RiteCMS/blob/master/cms/subtemplates/settings.inc.tpl#L64	cve@mitre.org	Product
https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67174	cve@mitre.org	Exploit Third Party Advisory
https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67174	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Third Party Advisory