Approved changes feed: RSS · Atom
cpe:2.3:a:atheos:atheos:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Atheos (8a5f70cf-79c5-52ca-90c1-112c207acb26) |
|---|---|
| Product | Atheos (902c974d-1297-580f-8253-711349015070) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/atheos/atheos |
purl2cpe | 2026-06-01 10:11:38.423297 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-49008 |
vulnerable | 2026-06-08 07:29:12.470254 |
Atheos Improper Input Validation Vulnerability Enables RCE in Common.php
Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe_execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.
Published: 2025-06-05T00:13:14.129Z
Updated: 2025-06-05T14:10:26.100Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47788 |
vulnerable | 2026-06-08 07:27:14.862036 |
Missing Path Validation Enables Path Traversal in Controller.php
Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was not properly validated, which could allow an attacker to execute arbitrary files on the server via path traversal. v602 contains a fix for the issue.
Published: 2025-05-15T19:40:58.761Z
Updated: 2025-05-19T14:43:37.687Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22152 |
vulnerable | 2026-06-08 07:10:52.273855 |
Improper Path Validation Enables Path Traversal in Multiple Components in Atheos
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600.
Published: 2025-01-10T15:23:16.919Z
Updated: 2025-01-10T16:08:16.253Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.