Atheos vulnerabilities
We track 3 vulnerabilities in Atheos products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 5, 2025.
Latest Atheos vulnerabilities
- 9.4 Critical severity
Atheos: Improper Neutralization of Special Elements used in an OS Command
Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos adm
- 9.4 Critical severity
Atheos: Improper Limitation of a Pathname to a Restricted Directory
Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was not properly validated, which could allow an attacker to execute arbitrary files on the server via p
- 9.4 Critical severity
Atheos: Improper Limitation of a Pathname to a Restricted Directory
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be