CVE-2020-25540: ThinkAdmin v6 directory traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote arbitrary file read with a high EPSS score and public exploit references, though not listed in CISA KEV.

What it is

ThinkAdmin v6 contains a directory traversal flaw (CWE-22) reachable through a GET request's encode parameter. An unauthenticated attacker can read arbitrary files on the remote server. Because no authentication or user interaction is required and confidentiality impact is high, exposed instances are at serious risk of sensitive file disclosure.

Impact

An attacker gains read access to arbitrary files on the server, which can expose configuration files, credentials, and application source code. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reached over the network via a crafted GET request to the vulnerable encode parameter; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but public exploit references are tagged 'Exploit' and EPSS shows a 30-day probability of 0.75332 (99.489th percentile), indicating high likelihood of exploitation activity.

What to do

• Upgrade ThinkAdmin to a version that fixes the directory traversal issue; if no fixed version is documented, apply the vendor's guidance from the referenced issue.
• Validate and sanitize the encode parameter, rejecting path traversal sequences and restricting file access to an allowlisted directory.
• Restrict network exposure of ThinkAdmin instances to trusted networks or place them behind an authenticated reverse proxy.
• Run the web service with least privilege and limit filesystem read permissions so traversal cannot reach sensitive files.

Detection

• Monitor web logs for GET requests containing traversal sequences (e.g., ../, ..%2f, encoded variants) in the encode parameter.
• Alert on requests to ThinkAdmin endpoints that return unusually large responses or file-like content types.
• Use file integrity or access monitoring to detect reads of sensitive files (configuration, credential stores) by the web process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.