{"id":"CVE-2025-13647","kind":"vulnerability","aliases":["CVE-2025-13647"],"related":[],"title":"Unnamed component leaks certificate file paths via crafted content-type header","description":"The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.","summary":"A crafted content-type header on certain requests makes the affected component reveal the file paths of its certificate files. The leaked paths could help an attacker plan later attacks against the system.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T10:17:10+00:00","first_seen_at":"2026-11-02T10:22:34+00:00","triaged_at":"2026-11-02T10:23:28+00:00","updated_at":"2026-11-02T10:23:28+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-02T10:23:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unnamed component leaks certificate file paths via crafted content-type header","impact":"low","summary":"A crafted content-type header on certain requests makes the affected component reveal the file paths of its certificate files. The leaked paths could help an attacker plan later attacks against the system.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Certificate file paths exposed to remote requesters, enabling follow-on attacks","analyst_note":"Identify the affected product from https://nvd.nist.gov/vuln/detail/CVE-2025-13647 CPE data and confirm whether a fixed version exists.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product, so it is unknown which systems are exposed. Teams should check their NVD entry for the vendor and product list before assuming they are clear.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":4145,"output_tokens":403,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-13647':15A,18A '-2025':14A,17A 'affect':30B,54C 'allow':73C 'attack':46B,49B,75C,112C 'certain':26B,70C 'certif':4A,38B,101C 'compon':2A,31B,55C 'compromis':114C 'confidenti':116C 'constraint':61C 'content':10A,22B,65C,85C 'content-typ':9A,21B,64C,84C 'could':43B,106C 'craft':8A,20B,79C 'cve':13A,16A 'disclosur':105C 'enforc':58C 'expect':59C 'exploit':89C 'exposur':95C 'fail':56C 'file':5A,34B,39B,98C,102C 'header':12A,24B,67C,87C 'help':44B 'inform':104C 'later':48B 'lead':91C 'leak':3A,41B 'leverag':109C 'make':28B 'manipul':83C 'path':6A,35B,42B,99C 'plan':47B 'potenti':107C 'process':69C 'request':27B,71C,80C 'reveal':32B 'submit':77C 'subsequ':111C 'success':88C 'system':52B,119C 'type':11A,23B,66C,86C 'unintend':94C 'unnam':1A 'valid':60C 'via':7A","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product, so it is unknown which systems are exposed. Teams should check their NVD entry for the vendor and product list before assuming they are clear.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other"],"first_public_at":"2026-11-02T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-13647","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13647","severity":null,"published_at":"2026-11-02T10:17:10+00:00","modified_at":"2026-11-02T10:17:10+00:00","first_seen_at":"2026-11-02T10:22:34+00:00","fetched_at":"2026-11-02T10:22:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}