CVE-2025-49415: Arbitrary File Access in FW Gallery

This Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and retrieve files from the web server's file system. Successful exploitation could lead to the exposure of sensitive data such as configuration files, database credentials, or even source code. Depending on the files accessible, an attacker could gain a deeper understanding of the application's architecture, identify further vulnerabilities, or compromise the entire system. The potential blast radius extends to any data stored on the server accessible through this path traversal.

1. Reserved2025-06-04
2. Published2025-06-17
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-49415 is to immediately upgrade the FW Gallery plugin to version 8.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Carefully review file permissions on the server to ensure that sensitive files are not accessible by the web server user. Monitor access logs for suspicious requests attempting to access files outside of the intended directory.