CVE-2025-67174

High · 7.5

CVSS

7.5

EPSS

1.3%

Published

Dec 17, 2025

CISA due date

—

The record

A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component

Affected packages

Ecosystem	Package	Introduced	Fixed