CVE-2025-69904
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
Risk Assessment
An attacker with administrative privileges can access confidential files such as configurations or credentials, potentially leading to further privilege escalation.
Recommendation
Update Linkstack to the latest version and verify proper server-side file path validation.
Other vulnerabilities in Linkstack
See all- CVE-2026-116052Medium
A cross-site request forgery (CSRF) vulnerability has been discovered in LinkStackOrg LinkStack up to version 4.8.8, affecting an unknown function. The attack can be exploited remotely, and the vendor did not respond to the disclosure.
- CVE-2026-7502Medium
A vulnerability was detected in LinkStackOrg LinkStack up to 4.8.6 in the saveLink function of the file app/Http/Controllers/UserController.php (Management Endpoint component). The manipulation leads to authorization bypass. The attack can be initiated remotely and the exploit is public; the fixing pull request awaits acceptance.
- CVE-2026-7501Low
A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. It affects the editPage function in app/Http/Controllers/UserController.php. Manipulation of the pageDescription argument can lead to cross site scripting, and the attack can be launched remotely.
Original NVD description (English source)
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS