CVE-2025-13283

HighCVSS 7.1

Published: 17/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

TenderDocTransfer developed by Chunghwa Telecom has an Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, posing a risk of information leakage or consuming hard drive space.

Risk Assessment

The risk includes potential leakage of confidential files from the user's system or consumption of disk space through mass file copying. An attacker could access sensitive data or cause system disruption.

Recommendation

It is recommended to immediately apply vendor-provided patches and implement CSRF protection mechanisms in the APIs. Also, restrict access to the application and monitor network activity.

Other vulnerabilities in TenderDocTransfer

CVE-2025-13282High
TenderDocTransfer developed by Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.

Original NVD description (English source)

TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS