CVE-2025-49008

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-49008
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-49008.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-49008
Related
  • GHSA-rwc2-4q8c-xj48
Published
2025-06-05T01:15:21Z
Modified
2025-06-05T20:49:52.281735Z
Summary
[none]
Details

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd() in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a Common::safe_execute function that sanitizes all arguments using escapeshellarg() prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.

References

Affected packages

Git / github.com/atheos/atheos

Affected ranges

Type
GIT
Repo
https://github.com/atheos/atheos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7e6c0eb45fa6d04d786a0037389540f2638fe792

Affected versions

v.*

v.1.0.0
v.1.0.1
v.1.1.0
v.1.1.1
v.1.1.3
v.1.1.4
v.1.1.5
v.1.1.6
v.1.2.0
v.1.2.1
v.1.3.0
v.1.3.1
v.1.3.10
v.1.3.11
v.1.3.12
v.1.3.13
v.1.3.2
v.1.3.3
v.1.3.5
v.1.3.8
v.1.4.0
v.1.4.1
v.1.4.2
v.1.4.3
v.1.5.0
v.1.5.1
v.1.6.0
v.1.7.0
v.1.7.5
v.1.7.8
v.1.7.9
v.1.8.0
v.1.8.1
v.1.8.2
v.1.8.3
v.1.8.4
v.1.9.0
v.1.9.1
v.1.9.2
v.2.0.0
v.2.0.2
v.2.0.4
v.2.0.6
v.2.0.7
v.2.1.0
v.2.1.3
v.2.1.4
v.2.1.6
v.2.1.7
v.2.1.8
v.2.1.9
v.2.2.1
v.2.2.2
v.2.2.3
v.2.2.4
v.2.2.5
v.2.2.6
v.2.2.7
v.2.2.8
v.2.2.9
v.2.3.0
v.2.3.1
v.2.3.2
v.2.3.3
v.2.3.4
v.2.3.5
v.2.3.6
v.2.3.7
v.2.3.8
v.2.3.9
v.2.4.0
v.2.4.1
v.2.4.2
v.2.4.3
v.2.5.0
v.2.5.1
v.2.5.2
v.2.5.3
v.2.5.4
v.2.6.0
v.2.6.1
v.2.6.2
v.2.6.3
v.2.6.4
v.2.6.5
v.2.6.6
v.2.7.0
v.2.7.1
v.2.7.2
v.2.7.4
v.2.7.5
v.2.8.0
v.2.8.1
v.2.8.3
v.2.8.4

v1.*

v1.0.0
v1.3.6

v3.*

v3.0.0
v3.0.1

v4.*

v4.0.0
v4.0.1
v4.2.0
v4.3.0

v5.*

v5.0.0
v5.5.0

Other

v601