Live › vulnerability › CVE-2025-13647
A crafted content-type header on certain requests makes the affected component reveal the file paths of its certificate files. The leaked paths could help an attacker plan later attacks against the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 10:22 UTC. All times on this page are UTC.
The sources do not name the affected product, so it is unknown which systems are exposed. Teams should check their NVD entry for the vendor and product list before assuming they are clear.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header.
Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
This page as .md · .json · in your agent: get_signal("CVE-2025-13647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.