CVE-2025-1300 json
Open redirect in CodeChecker web server
published 2025-02-28 20 mo ago modified 2026-07-07 4 mo ago also GHSA-g839-x3p3-g5fm , PYSEC-2026-1259 , EUVD-2025-5562
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway.
This issue affects CodeChecker: through 6.24.5.
Patch / fix
- pypi codechecker 6.24.6
- ericsson codechecker 6.24.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | codechecker | <6.24.6 |
6.24.6 |
Affected products
- Ericsson CodeChecker
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/Ericsson/codechecker/security/advisories/GHSA-g839-x3p3-g5fm
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-1300
advisory
-
github.com
/Ericsson/codechecker
package
-
pypi.org
/project/codechecker
package
-
github.com
/advisories/GHSA-g839-x3p3-g5fm
advisory
Sources
- CVE List CVE-2025-1300
- GitHub Advisory GHSA-g839-x3p3-g5fm
- NVD CVE-2025-1300
- OSV PYSEC-2026-1259
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.