CVE-2025-15637

HighCVSS 8.1

Published: 20/08/2026(UTC)Updated: 05/10/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Unauthenticated Local File Inclusion in Shuffle versions up to and including 1.8.

Risk Assessment

An attacker can read arbitrary files from the server, potentially leading to disclosure of sensitive data or further system compromise.

Recommendation

Update Shuffle to the latest version that includes the security fix.

Other vulnerabilities in Shuffle

CVE-2026-92716Critical
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS