CVE-2025-70028 Path traversal in n/a

High 7.5 Published 9 Mar 2026 Updated 11 Mar 2026

Attackers can exploit a path traversal vulnerability in the SunbirdEd portal to access restricted files and directories.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-70028?

CVE-2025-70028 is a high-severity path traversal vulnerability in n/a, published on 9 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.

Weakness: CWE-22

Which versions are affected by CVE-2025-70028?

It affects 1 product.

Products include Sunbird Sunbirded-Portal.

How do I fix CVE-2025-70028?

No fix has been published for CVE-2025-70028 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-70028 being exploited?

There is no known exploitation of CVE-2025-70028 in the wild and no public exploit code.

Sources

Also known as GHSA-xhch-j6v3-w4f3.