DreamFactory has a directory traversal

HIGH 7.2CVE-2025-55988 · GHSA-gv7f-w92j-383q · Published 20/03/2026 · updated 17/06/2026

In short

CVE-2025-55988 is a HIGH (CVSS 7.2) vulnerability affecting dreamfactory/df-core, dreamfactory core (dreamfactory).
Chance of exploitation in the next 30 days (EPSS): 0.92%, higher than 60.5% of all vulnerabilities.
Fix: update to 1.0.4 or later.

Package	Affected versions	Patched versions
dreamfactory/df-core Packagist	`< 1.0.4`	`1.0.4`
dreamfactory core dreamfactory	`= 1.0.3`	No fix yet

Description

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.

NVD description

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.

References

nvd.nist.gov/vuln/detail/CVE-2025-55988 · ADVISORY
dreamfactorysoftware/df-core commit 5435460 · WEB
dreamfactorysoftware/df-core · PACKAGE
pentest-tools.com/PTT-2025-001-RemoteCodeExecution-via-URL-Path-Traversal.pdf · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free