Dashboard / CVE-2025-47221

CVE-2025-47221

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 71/100
Published: 2025-11-13 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
keyfactor signserver < 7.3.1

References & Advisories (3)

Bug Bounty Relevance

71 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002660
Percentile 18.7%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00266
2026-11-13
0.00266
2026-11-12
0.00266
2026-11-10
0.00266
2026-11-09
0.00266
2026-11-08
0.00266
2026-11-07
0.00266
2026-11-06
0.00266
2026-11-05
0.00266

Intelligence Sources

nvd ref →

External Links