CVE-2025-27092 | cmu-sei GHOSTS prior 8.2.7.90 /api/npcs/{id}/photo photoLink path traversal (GHSA-qr67-m6w9-wj3j)

A vulnerability classified as critical has been found in cmu-sei GHOSTS. This affects an unknown part of the file /api/npcs/{id}/photo. The manipulation of the argument photoLink leads to path traversal.

This vulnerability is uniquely identified as CVE-2025-27092. The attack can only be done within the local network. There is no exploit available.

It is recommended to upgrade the affected component.