{"document": {"category": "csaf_vex", "csaf_version": "2.0", "lang": "en-US", "publisher": {"category": "coordinator", "contact_details": "https://www.cisa.gov/report", "issuing_authority": "CISA", "name": "CISA", "namespace": "https://www.cisa.gov/"}, "title": "Census CSWeb multiple vulnerabilities", "tracking": {"current_release_date": "2026-02-23T00:00:00Z", "generator": {"engine": {"name": "VINCE-NT", "version": "1.13.0+build.51"}}, "id": "VA-26-082-01", "initial_release_date": "2026-02-23T00:00:00Z", "status": "final", "version": "1.0.0", "revision_history": [{"number": "1.0.0", "summary": "Initial publication", "date": "2026-02-23T00:00:00Z"}]}, "distribution": {"tlp": {"label": "WHITE"}}, "notes": [{"text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).", "title": "Legal Notice", "category": "legal_disclaimer"}, {"text": "Worldwide", "title": "Countries and Areas Deployed", "category": "other"}, {"text": "Information Technology", "title": "Critical Infrastructure Sectors", "category": "other"}, {"text": "Census CSWeb allows a remote, authenticated attacker to perform actions such as path traversal, arbitrary file upload and stored XSS. An unauthenticated attacker could also send requests to configuration files in some deployments.", "title": "Risk Evaluation", "category": "summary"}, {"text": "Update to 8.1.0 alpha.", "title": "Recommended Practices", "category": "general"}, {"text": "United States", "title": "Company Headquarters Location", "category": "other"}], "references": [{"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json", "summary": "Vulnerability Advisory VA-26-082-01 CSAF", "category": "self"}]}, "product_tree": {"branches": [{"category": "vendor", "name": "Census", "branches": [{"category": "product_name", "name": "CSWeb", "branches": [{"category": "product_version_range", "name": ">=8.0.1|<8.1.0 alpha", "product": {"name": "Census CSWeb >=8.0.1|<8.1.0 alpha", "product_id": "CSAFPID-0001"}}, {"category": "product_version", "name": "8.1.0 alpha", "product": {"name": "Census CSWeb 8.1.0 alpha", "product_id": "CSAFPID-0002"}}]}]}]}, "vulnerabilities": [{"cve": "CVE-2025-60946", "cwe": {"id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, "notes": [{"category": "summary", "text": "Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha.", "title": "Description"}, {"category": "details", "title": "SSVC", "text": "SSVCv2/E:P/A:N/T:T/2026-01-22T19:55:46Z/"}], "title": "Census CSWeb path traversal", "product_status": {"known_affected": ["CSAFPID-0001"], "fixed": ["CSAFPID-0002"]}, "references": [{"category": "external", "summary": "github.com", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91"}, {"category": "external", "summary": "github.com", "url": "https://github.com/hx381/cspro-exploits"}, {"category": "external", "summary": "CVE-2025-60946", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60946"}, {"category": "external", "summary": "VA-26-082-01", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json"}], "scores": [{"cvss_v3": {"baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "products": ["CSAFPID-0001"]}], "remediations": [{"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0001"], "date": "2026-03-18T00:00:00Z"}, {"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0002"], "date": "2026-03-18T00:00:00Z"}], "release_date": "2025-10-14T00:00:00Z"}, {"cve": "CVE-2025-60947", "cwe": {"id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type"}, "notes": [{"category": "summary", "text": "Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.", "title": "Description"}, {"category": "details", "title": "SSVC", "text": "SSVCv2/E:N/A:N/T:T/2026-01-23T18:22:11Z/"}], "title": "Census CSWeb arbitrary file upload", "product_status": {"known_affected": ["CSAFPID-0001"], "fixed": ["CSAFPID-0002"]}, "references": [{"category": "external", "summary": "github.com", "url": "https://github.com/hx381/cspro-exploits"}, {"category": "external", "summary": "github.com", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91"}, {"category": "external", "summary": "CVE-2025-60947", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60947"}, {"category": "external", "summary": "VA-26-082-01", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json"}], "scores": [{"cvss_v3": {"baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "products": ["CSAFPID-0001"]}], "remediations": [{"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0001"], "date": "2026-03-18T00:00:00Z"}, {"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0002"], "date": "2026-03-18T00:00:00Z"}], "release_date": "2025-10-14T00:00:00Z"}, {"cve": "CVE-2025-60948", "cwe": {"id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}, "notes": [{"category": "summary", "text": "Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.", "title": "Description"}, {"category": "details", "title": "SSVC", "text": "SSVCv2/E:N/A:N/T:P/2026-01-23T18:24:51Z/"}], "title": "Census CSWeb stored XSS", "product_status": {"known_affected": ["CSAFPID-0001"], "fixed": ["CSAFPID-0002"]}, "references": [{"category": "external", "summary": "github.com", "url": "https://github.com/hx381/cspro-exploits"}, {"category": "external", "summary": "github.com", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91"}, {"category": "external", "summary": "CVE-2025-60948", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60948"}, {"category": "external", "summary": "VA-26-082-01", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json"}], "scores": [{"cvss_v3": {"baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "products": ["CSAFPID-0001"]}], "remediations": [{"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0001"], "date": "2026-03-18T00:00:00Z"}, {"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0002"], "date": "2026-03-18T00:00:00Z"}], "release_date": "2025-10-14T00:00:00Z"}, {"cve": "CVE-2025-60949", "cwe": {"id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor"}, "notes": [{"category": "summary", "text": "Census CSWeb 8.0.1 allows \"app/config\" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.", "title": "Description"}, {"category": "details", "title": "SSVC", "text": "SSVCv2/E:N/A:Y/T:T/2026-01-23T18:26:10Z/"}], "title": "Census CSWeb leaked configuration files", "product_status": {"known_affected": ["CSAFPID-0001"], "fixed": ["CSAFPID-0002"]}, "references": [{"category": "external", "summary": "github.com", "url": "https://github.com/hx381/cspro-exploits"}, {"category": "external", "summary": "github.com", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91"}, {"category": "external", "summary": "CVE-2025-60949", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60949"}, {"category": "external", "summary": "VA-26-082-01", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json"}], "scores": [{"cvss_v3": {"baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "products": ["CSAFPID-0001"]}], "remediations": [{"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0001"], "date": "2026-03-18T00:00:00Z"}, {"category": "vendor_fix", "details": "Fixed in 8.1.0 alpha.", "url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91", "product_ids": ["CSAFPID-0002"], "date": "2026-03-18T00:00:00Z"}], "release_date": "2025-10-14T00:00:00Z"}]}