CVE-2025-15015Ragic｜Enterprise Cloud Database - Arbitrary File Read

8.7HighCVSS base score
0.61%Exploitation in 30 daysEPSS · top 50% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

Timeline

2025
22 Dec 2025
22 Dec 2025
ID reserved
By twcert
22 Dec 2025
22 Dec 2025
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-15015, by who scored it
Scored by	CVSS	Score	Vector
twcertCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
twcertCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Analyzed	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.61% · top 50% of all CVEs (12 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Affected products

Ragic · Enterprise Cloud Database
- affected 0

What to do

Solution: Contact the vendor to Install the patch.

References2

https://www.twcert.org.tw/tw/cp-132-10587-797c6-1.html (opens in a new tab)third-party-advisory
https://www.twcert.org.tw/en/cp-139-10588-771e5-2.html (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-15015](https://cveledger.app/badge/CVE-2025-15015.svg)](https://cveledger.app/cve/CVE-2025-15015)

Record last updated 22 Dec 2025, 14:50 UTC.