CVE-2025-30582: Path Traversal in DyaPress ERP/CRM

The Path Traversal vulnerability in DyaPress ERP/CRM allows an attacker to include arbitrary files from the server's filesystem. This can be exploited to read sensitive configuration files, source code, or even execute malicious PHP code. Successful exploitation could result in the disclosure of database credentials, API keys, or other confidential information. Furthermore, an attacker could potentially gain remote code execution by including a malicious PHP script, effectively compromising the entire server. The impact is amplified if the DyaPress ERP/CRM system is exposed directly to the internet or if it interacts with other sensitive systems.

1. Reserved2025-03-24
2. Published2025-04-10
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-30582 is to upgrade DyaPress ERP/CRM to version 18.0.3 or later, which contains the fix. If upgrading immediately is not possible, consider implementing temporary workarounds. Restrict access to the DyaPress ERP/CRM application through a Web Application Firewall (WAF) or proxy server, configuring rules to block requests containing path traversal sequences (e.g., ../). Review and harden file permissions on the server to limit the attacker's ability to read sensitive files, even if they manage to include them. Monitor system logs for suspicious activity, particularly attempts to access files outside of the expected directories.