CVE-2025-1300 Open redirect in CodeChecker web server

What is CVE-2025-1300?

CVE-2025-1300 is a medium-severity vulnerability in Ericsson CodeChecker, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway.

This issue affects CodeChecker: through 6.24.5.

Weakness: CWE-601

Which versions are affected by CVE-2025-1300?

3 open source packages ship an affected version, including codechecker. It affects 1 product.

Products include Ericsson Codechecker.

How do I fix CVE-2025-1300?

Upgrade codechecker to 6.24.6 or later.

Is CVE-2025-1300 being exploited?

There is no known exploitation of CVE-2025-1300 in the wild and no public exploit code.

Other vulnerabilities in Ericsson CodeChecker

• CVE-2024-10081 codechecker vulnerable to authentication bypass when using specifically crafted URLs Critical 10.0
• CVE-2026-25660 Authentication bypass for certain API calls Critical 9.3
• CVE-2024-10082 codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service High 8.7
• CVE-2024-53829 Cross-Site Request Forgery in CodeChecker API High 8.2
• CVE-2023-49793 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g839-x3p3-g5fm, PYSEC-2026-1259.