---
id: "CVE-2025-13647"
kind: "vulnerability"
aliases: ["CVE-2025-13647"]
title: "Unnamed component leaks certificate file paths via crafted content-type header"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other"]
not_affected_if: []
published_at: "2026-11-02T10:17:10+00:00"
first_seen_at: "2026-11-02T10:22:34+00:00"
updated_at: "2026-11-02T10:23:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13647", "first_seen_at": "2026-11-02T10:22:34+00:00"}]
---

# Unnamed component leaks certificate file paths via crafted content-type header

A crafted content-type header on certain requests makes the affected component reveal the file paths of its certificate files. The leaked paths could help an attacker plan later attacks against the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T10:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-13647

## From the sources

The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.

Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_