CVE-2025-41736

High · 8.8

CVSS

8.8

EPSS

0.8%

Published

Nov 18, 2025

CISA due date

—

The record

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

Affected packages

Ecosystem	Package	Introduced	Fixed