CVE-2025-66905

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Dec 19, 2025

CISA due date

—

The record

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system.

Affected packages

Ecosystem	Package	Introduced	Fixed