mojoPortal BetterImageGallery - Path Traversal (CVE-2025-28367)
Description
mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
psychologyCrowdSec Analysis
CVE-2025-28367 is a directory traversal vulnerability in mojoPortal that can allow attackers to access sensitive files, such as configuration files, through the BetterImageGallery API. By exploiting this flaw, an attacker may be able to retrieve the application's MachineKey, potentially leading to further compromise.
CrowdSec has been tracking this vulnerability and its exploits since 24th of April 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-28367 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-28367 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-28367 is currently experiencing high visibility and active exploitation across the internet.
Attackers have been observed sending requests to endpoints containing /api/betterimagegallery/imagehandler with traversal patterns in the path.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-04-21 |
| Rule Released | 2025-04-24 |
| CrowdSec First Seen | 2025-04-29 |