ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2025-48382

Fess is a deployable Enterprise Search Server.

Published May 27, 2025 · catalog updated May 27, 2025 · Fess is a deployable

Check this week

CVE-2025-48382 is not in CISA KEV. FIRST estimates a 15.00% chance of exploitation in the next 30 days. Check whether you run Fess is a deployable.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Fess is a deployable).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low1.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
15.00%
Remediation
Version ranges on file
Affected products
vendor codelibs fess < 14.19.2

Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact. This issue has been patched in version 14.19.2. A worka

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor codelibs fess < 14.19.2< 14.19.2

How to fix CVE-2025-48382

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-48382 is not in CISA KEV. FIRST estimates a 15.00% chance of exploitation in the next 30 days. Check whether you run Fess is a deployable.

Which versions are affected?

Compare what you have installed with codelibs fess < 14.19.2 < 14.19.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 15.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 27, 2025 · EUVD

    Detected

    Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. This issue primarily affects environments wh

  2. May 27, 2025 · EUVD

    Updated

    Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. This issue primarily affects environments wh

Sources

  • CVE.orgVulnerability recordCVE-2025-48382

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-28217

    Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog May 27, 2025. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.