CVE-2025-52023 Information disclosure in n/a

Medium 5.3 Published 23 Jan 2026 Updated 5 Jul 2026

Unauthenticated attackers can trigger detailed error messages on public API endpoints, exposing internal file paths and code snippets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-52023?

CVE-2025-52023 is a medium-severity vulnerability in n/a, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.

Weakness: CWE-209

Which versions are affected by CVE-2025-52023?

It affects 1 product.

Products include Aptsys Gemscms Backend.

How do I fix CVE-2025-52023?

No fix has been published for CVE-2025-52023 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-52023 being exploited?

There is no known exploitation of CVE-2025-52023 in the wild and no public exploit code.

Sources

Also known as GHSA-39jx-3m57-r6qr.