Altumcode vulnerabilities
Published CVEs affecting Altumcode products: 3 record(s), with severity, exploitation and fixes.
CVE-2025-69602
Critical · 9.1
CWE-384 Jan 28, 2026
66biolinks (AltumCode) Session Fixation After Login
A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session.
CVE-2025-69601
Medium · 6.5
CWE-22 Jan 28, 2026
Path Traversal in Altumcode 66biolinks
A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically extracted without validating or sanitizing file paths. An attacker can include traversal sequences (e.g., ../) in ZIP entries to write files outside the intended extraction directory. This allows static files (html, js, css, images) file write to unintended locations, or overwriting existing HTML files, potentially leading to content defacement and, in certain deployments, further impact if sensitive files are overwritten.
CVE-2025-66939
Medium · 5.4
CWE-79 Jan 12, 2026
Cross-site Scripting (XSS) in Altumcode 66biolinks
Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file