CVE-2025-69161

HighCVSS 8.1

Published: 17/06/2026(UTC)Updated: 06/10/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

Summary

There is a vulnerability in Snowy versions up to 1.13 that allows unauthenticated local file inclusion.

Risk Assessment

An attacker could gain access to sensitive files on the server, potentially leading to data exposure or system takeover.

Recommendation

It is recommended to upgrade to the latest version of Snowy to mitigate this vulnerability.

Other vulnerabilities in Snowy

CVE-2026-110214Low
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS