{"action":"Upgrade dreamfactory/df-core to 1.0.4 or later.","affected":[{"fixed":"1.0.4","introduced":"0"}],"component":"dreamfactory/df-core","cve_ids":["CVE-2025-55988"],"ecosystem":"Packagist","epss":0.00899,"exploited":false,"fixed_versions":["1.0.4"],"ghsa_id":"GHSA-gv7f-w92j-383q","id":"tcs_01M5KF33FN95T286FAK8B305KB","modified_at":"2026-03-20T22:11:22.273031Z","published_at":"2026-03-20T21:31:28Z","references":["https://osv.dev/vulnerability/GHSA-gv7f-w92j-383q","https://nvd.nist.gov/vuln/detail/CVE-2025-55988","https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756a5a22f6f56828950#diff-e57a7c0af25166ac8f02695307c6c413ca4ba0a48a20b2202ad910654528aab1","https://github.com/dreamfactorysoftware/df-core","https://pentest-tools.com/PTT-2025-001-RemoteCodeExecution-via-URL-Path-Traversal.pdf"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-gv7f-w92j-383q","url":"https://osv.dev/vulnerability/GHSA-gv7f-w92j-383q"}],"summary":"DreamFactory has a directory traversal"}