{"id":"CVE-2025-14311","details":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3.","modified":"2026-08-12T03:51:32.110786757Z","published":"2025-12-09T07:56:34.477Z","database_specific":{"cna_assigner":"GovTech CSG","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14311.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14311.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14311"},{"type":"FIX","url":"https://github.com/JMRI/JMRI/pull/14340"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jmri/jmri","events":[{"introduced":"0"},{"fixed":"f64a88e8b89a6f37bf5525834672fd0d078884d9"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"fixed":"5.13.3"}]}}],"versions":["v5.13.2","v5.11.7","v5.11.6","v5.11.4","v5.11.3","v5.11.2","v5.11.1","v5.9.7","v5.9.6","v5.9.5","v5.9.4","v5.9.3","v5.9.2","v5.9.1","v5.7.9","v5.7.8","v5.7.7","v5.7.6","v5.7.5","v5.7.4","v5.7.3","v5.7.2","v5.7.1","v5.5.8","v5.5.7","v5.5.6","v5.5.5","v5.5.4","v5.5.3","v5.5.2","v5.5.1","v5.3.8","v5.3.7","v5.3.6","v5.3.5","v5.3.4","v5.3.3","v5.3.2","v5.3.1","V5.3.1","v5.1.7","v5.1.6","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","v4.99.9","v4.99.6","4.99.6","v4.99.8","v4.99.7","v4.99.5","v4.26","v4.99.4","First-J11-master","v4.27.1","Last-Java-8","v4.25.9","v4.25.6","v4.25.5","v4.25.4","v4.25.3","v4.25.2","v4.23.8","v4.23.5","v4.23.3","v4.21.4","v4.21.2","v4.19.7","v4.19.5","v4.19.6","v4.19.4","v4.19.3","v4.17.5","v4.19.2","v4.19.1","v4.17.7","v4.17.6","v4.17.4","v4.17.3","v4.17.1","v4.15.8","v4.15.7","v4.15.6","v4.15.5","v4.15.3","v4.15.2","v4.15.1","v4.13.5","v4.13.4","v4.13.2","v4.13.1","v4.11.9","v4.11.8","untagged-3b3fa919c006ff808489","v4.11.6","v4.11.5","v4.11.4","v4.11.3","v4.11.1","v4.9.4","v4.9.2","v4.7.7","v4.7.3","v4.5.6","v4.5.4","v4.5.3a","v4.5.3","v4.5.1","v4.3.7","v4.3.4","v4.3.1","v4.1.3","svn-30001"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14311.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}