Yottamaster DM2/DM3/DM200 File Upload path traversal_CVE-2025-14224

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Description

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2025-14224

Source VulDB

Published Dec 8, 2025 at 08:32

Affected Product

Vendor Yottamaster

Product DM2

Version 1.2.0

Affected Versions Yottamaster DM2 1.2.0
Yottamaster DM2 1.2.1
Yottamaster DM2 1.2.2
Yottamaster DM2 1.2.3
Yottamaster DM2 1.2.4
Yottamaster DM2 1.2.5
Yottamaster DM2 1.2.6
Yottamaster DM2 1.2.7
Yottamaster DM2 1.2.8
Yottamaster DM2 1.2.9
Yottamaster DM2 1.2.10
Yottamaster DM2 1.2.11
Yottamaster DM2 1.2.12
Yottamaster DM2 1.2.13
Yottamaster DM2 1.2.14
Yottamaster DM2 1.2.15
Yottamaster DM2 1.2.16
Yottamaster DM2 1.2.17
Yottamaster DM2 1.2.18
Yottamaster DM2 1.2.19
Yottamaster DM2 1.2.20
Yottamaster DM2 1.2.21
Yottamaster DM2 1.2.22
Yottamaster DM2 1.2.23
Yottamaster DM2 1.9.0
Yottamaster DM2 1.9.1
Yottamaster DM2 1.9.2
Yottamaster DM2 1.9.3
Yottamaster DM2 1.9.4
Yottamaster DM2 1.9.5
Yottamaster DM2 1.9.6
Yottamaster DM2 1.9.7
Yottamaster DM2 1.9.8
Yottamaster DM2 1.9.9
Yottamaster DM2 1.9.10
Yottamaster DM2 1.9.11
Yottamaster DM2 1.9.12
Yottamaster DM3 1.2.0
Yottamaster DM3 1.2.1
Yottamaster DM3 1.2.2
Yottamaster DM3 1.2.3
Yottamaster DM3 1.2.4
Yottamaster DM3 1.2.5
Yottamaster DM3 1.2.6
Yottamaster DM3 1.2.7
Yottamaster DM3 1.2.8
Yottamaster DM3 1.2.9
Yottamaster DM3 1.2.10
Yottamaster DM3 1.2.11
Yottamaster DM3 1.2.12
Yottamaster DM3 1.2.13
Yottamaster DM3 1.2.14
Yottamaster DM3 1.2.15
Yottamaster DM3 1.2.16
Yottamaster DM3 1.2.17
Yottamaster DM3 1.2.18
Yottamaster DM3 1.2.19
Yottamaster DM3 1.2.20
Yottamaster DM3 1.2.21
Yottamaster DM3 1.2.22
Yottamaster DM3 1.2.23
Yottamaster DM3 1.9.0
Yottamaster DM3 1.9.1
Yottamaster DM3 1.9.2
Yottamaster DM3 1.9.3
Yottamaster DM3 1.9.4
Yottamaster DM3 1.9.5
Yottamaster DM3 1.9.6
Yottamaster DM3 1.9.7
Yottamaster DM3 1.9.8
Yottamaster DM3 1.9.9
Yottamaster DM3 1.9.10
Yottamaster DM3 1.9.11
Yottamaster DM3 1.9.12
Yottamaster DM200 1.2.0
Yottamaster DM200 1.2.1
Yottamaster DM200 1.2.2
Yottamaster DM200 1.2.3
Yottamaster DM200 1.2.4
Yottamaster DM200 1.2.5
Yottamaster DM200 1.2.6
Yottamaster DM200 1.2.7
Yottamaster DM200 1.2.8
Yottamaster DM200 1.2.9
Yottamaster DM200 1.2.10
Yottamaster DM200 1.2.11
Yottamaster DM200 1.2.12
Yottamaster DM200 1.2.13
Yottamaster DM200 1.2.14
Yottamaster DM200 1.2.15
Yottamaster DM200 1.2.16
Yottamaster DM200 1.2.17
Yottamaster DM200 1.2.18
Yottamaster DM200 1.2.19
Yottamaster DM200 1.2.20
Yottamaster DM200 1.2.21
Yottamaster DM200 1.2.22
Yottamaster DM200 1.2.23
Yottamaster DM200 1.9.0
Yottamaster DM200 1.9.1
Yottamaster DM200 1.9.2
Yottamaster DM200 1.9.3
Yottamaster DM200 1.9.4
Yottamaster DM200 1.9.5
Yottamaster DM200 1.9.6
Yottamaster DM200 1.9.7
Yottamaster DM200 1.9.8
Yottamaster DM200 1.9.9
Yottamaster DM200 1.9.10
Yottamaster DM200 1.9.11
Yottamaster DM200 1.9.12

CWE Classification

CWE-22

References

{
    "lastseen": "",
    "description": "A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2025-12-08T08:32:06.058Z",
    "modified": "2025-12-08T08:32:06.058Z",
    "type": "cve",
    "title": "Yottamaster DM2/DM3/DM200 File Upload path traversal",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.334666\nhttps://vuldb.com/?ctiid.334666\nhttps://vuldb.com/?submit.701673\nhttps://www.notion.so/2b76cf4e528a80f6ae50fe21b13ff0b8",
    "id": "CVE-2025-14224",
    "bulletinFamily": "",
    "cwe": [
        "CWE-22"
    ],
    "cvelist": null,
    "sourceData": "Yottamaster DM2 1.2.0\nYottamaster DM2 1.2.1\nYottamaster DM2 1.2.2\nYottamaster DM2 1.2.3\nYottamaster DM2 1.2.4\nYottamaster DM2 1.2.5\nYottamaster DM2 1.2.6\nYottamaster DM2 1.2.7\nYottamaster DM2 1.2.8\nYottamaster DM2 1.2.9\nYottamaster DM2 1.2.10\nYottamaster DM2 1.2.11\nYottamaster DM2 1.2.12\nYottamaster DM2 1.2.13\nYottamaster DM2 1.2.14\nYottamaster DM2 1.2.15\nYottamaster DM2 1.2.16\nYottamaster DM2 1.2.17\nYottamaster DM2 1.2.18\nYottamaster DM2 1.2.19\nYottamaster DM2 1.2.20\nYottamaster DM2 1.2.21\nYottamaster DM2 1.2.22\nYottamaster DM2 1.2.23\nYottamaster DM2 1.9.0\nYottamaster DM2 1.9.1\nYottamaster DM2 1.9.2\nYottamaster DM2 1.9.3\nYottamaster DM2 1.9.4\nYottamaster DM2 1.9.5\nYottamaster DM2 1.9.6\nYottamaster DM2 1.9.7\nYottamaster DM2 1.9.8\nYottamaster DM2 1.9.9\nYottamaster DM2 1.9.10\nYottamaster DM2 1.9.11\nYottamaster DM2 1.9.12\nYottamaster DM3 1.2.0\nYottamaster DM3 1.2.1\nYottamaster DM3 1.2.2\nYottamaster DM3 1.2.3\nYottamaster DM3 1.2.4\nYottamaster DM3 1.2.5\nYottamaster DM3 1.2.6\nYottamaster DM3 1.2.7\nYottamaster DM3 1.2.8\nYottamaster DM3 1.2.9\nYottamaster DM3 1.2.10\nYottamaster DM3 1.2.11\nYottamaster DM3 1.2.12\nYottamaster DM3 1.2.13\nYottamaster DM3 1.2.14\nYottamaster DM3 1.2.15\nYottamaster DM3 1.2.16\nYottamaster DM3 1.2.17\nYottamaster DM3 1.2.18\nYottamaster DM3 1.2.19\nYottamaster DM3 1.2.20\nYottamaster DM3 1.2.21\nYottamaster DM3 1.2.22\nYottamaster DM3 1.2.23\nYottamaster DM3 1.9.0\nYottamaster DM3 1.9.1\nYottamaster DM3 1.9.2\nYottamaster DM3 1.9.3\nYottamaster DM3 1.9.4\nYottamaster DM3 1.9.5\nYottamaster DM3 1.9.6\nYottamaster DM3 1.9.7\nYottamaster DM3 1.9.8\nYottamaster DM3 1.9.9\nYottamaster DM3 1.9.10\nYottamaster DM3 1.9.11\nYottamaster DM3 1.9.12\nYottamaster DM200 1.2.0\nYottamaster DM200 1.2.1\nYottamaster DM200 1.2.2\nYottamaster DM200 1.2.3\nYottamaster DM200 1.2.4\nYottamaster DM200 1.2.5\nYottamaster DM200 1.2.6\nYottamaster DM200 1.2.7\nYottamaster DM200 1.2.8\nYottamaster DM200 1.2.9\nYottamaster DM200 1.2.10\nYottamaster DM200 1.2.11\nYottamaster DM200 1.2.12\nYottamaster DM200 1.2.13\nYottamaster DM200 1.2.14\nYottamaster DM200 1.2.15\nYottamaster DM200 1.2.16\nYottamaster DM200 1.2.17\nYottamaster DM200 1.2.18\nYottamaster DM200 1.2.19\nYottamaster DM200 1.2.20\nYottamaster DM200 1.2.21\nYottamaster DM200 1.2.22\nYottamaster DM200 1.2.23\nYottamaster DM200 1.9.0\nYottamaster DM200 1.9.1\nYottamaster DM200 1.9.2\nYottamaster DM200 1.9.3\nYottamaster DM200 1.9.4\nYottamaster DM200 1.9.5\nYottamaster DM200 1.9.6\nYottamaster DM200 1.9.7\nYottamaster DM200 1.9.8\nYottamaster DM200 1.9.9\nYottamaster DM200 1.9.10\nYottamaster DM200 1.9.11\nYottamaster DM200 1.9.12",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "DM2",
    "version": "1.2.0",
    "vendor": "Yottamaster",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}