Security readout for executives and security teams
Plain-English summary
Surreal ToDo 0.6.1.2 has a file-read flaw in index.php. An unauthenticated attacker may manipulate the content parameter to access files outside the intended application path. This can expose configuration or initialization files. Public exploit information exists, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat as a targeted medium-priority issue. It is not listed as known exploited, but public exploit information and potential configuration-file disclosure justify prompt inventory, exposure reduction, and remediation planning for any affected deployment.
Technical view
CVE-2018-25184 is a CWE-22 path traversal/local file inclusion issue in Getsurreal Surreal ToDo 0.6.1.2. The content parameter in index.php can accept traversal sequences, allowing arbitrary file reads. CVSS v4.0 is 6.9 with high vulnerable-system confidentiality impact and no integrity or availability impact listed.
Likely exposure
Exposure is limited to organizations running Surreal ToDo 0.6.1.2, especially where the application is reachable by untrusted users. The sources do not identify other affected versions or products. Inventory confirmation is important because this appears to be a niche or legacy application.
Exploitation context
ExploitDB is cited, so public exploit information exists. CISA KEV status is false in the provided bundle, and no cited source confirms active exploitation. The practical risk is sensitive local file disclosure if an attacker can reach the vulnerable index.php endpoint.
Researcher notes
Evidence is limited to the CVE record, VulnCheck advisory, and ExploitDB reference. Do not assume broader version impact, active exploitation, or a vendor patch from these sources. Validate in a controlled environment without retrieving sensitive files or publishing weaponized details.
Mitigation direction
- Identify and prioritize any Surreal ToDo 0.6.1.2 deployments.
- Check vendor or maintainer guidance for fixed versions or official mitigations.
- Restrict network access to trusted users until remediation is confirmed.
- Retire or isolate the application if no supported fix is available.
- Monitor for suspicious requests involving traversal patterns and the content parameter.
Validation and detection
- Confirm product name and version on all suspected hosts.
- Verify whether index.php is reachable by unauthenticated or untrusted users.
- Review web logs for anomalous content parameter access attempts.
- Assess whether sensitive local files could be exposed from the web server context.
- Document compensating controls if patch status cannot be confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25184 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-45826CVE reference · exploit
- VulnCheck Advisory: Surreal ToDo 0.6.1.2 Local File Inclusion via index.phpCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.