CVE-2025-28367: mojoPortal directory traversal exposing Web.config and the machine key
The short version: mojoPortal — an open-source ASP.NET content-management system — has a directory-traversal flaw (CVE-2025-28367) in its BetterImageGallery image handler that lets an unauthenticated attacker read files outside the web root, including Web.config and the ASP.NET machine key. That's a file read with an outsized second act: a leaked machine key can be turned into code execution. It is not in CISA's KEV catalog. If you run mojoPortal 2.9.0.1 or earlier, update and rotate keys. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate by default — but the leaked machine key raises real escalation risk (see below) |
| CVSS v3.1 (NVD) | 6.5 — Medium · AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N (per NVD's secondary CVSS; a primary NVD base score was not published at time of writing) |
| EPSS | ~2.15% · 80.06th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in-the-wild by an authoritative catalog at time of writing |
| Vulnerability type | CWE-284 improper access control / directory traversal → disclosure of Web.config and the ASP.NET machine key |
| Requires authenticated session? | No — unauthenticated |
| Affected | mojoPortal 2.9.0.1 and earlier |
| Fixed in | Unknown at time of writing — apply the latest mojoPortal release |
What you need to know
mojoPortal serves public websites, so an internet-facing instance is normal. CVE-2025-28367 lives in the BetterImageGallery API controller's image handler: a traversal sequence in the path parameter escapes the intended directory and returns arbitrary files — including Web.config, which holds the application's machine key.
The file read is the setup; the machine key is the payoff.
- How they find it — internet-wide scanning and the mojoPortal fingerprint surface exposed instances.
- How they use it — a crafted request to the image handler reads
Web.configwithout authentication. - What it leads to — with the machine key, an attacker can forge trusted ASP.NET data (for example, ViewState), which is a well-known route to server-side code execution. So while the flaw itself is "read a file," its consequences can reach further.
How serious we see it
Moderate — with honest escalation risk.
On its own mechanics — an unauthenticated read with high attack complexity — it lands at a middling score, and it isn't in KEV. We keep the headline at Moderate for that reason. But the specific file it exposes changes the calculus: a leaked ASP.NET machine key is a known stepping stone to code execution, so an exposed, unpatched instance should be treated with more urgency than "information disclosure" implies. The reassuring part: it's fully in your hands to fix — update, and rotate the key.
Recommendations
- Update mojoPortal. Move to the latest release; do not remain on 2.9.0.1 or earlier.
- Rotate the machine key. Assume the
Web.configmachine key was exposed and regenerate it, then invalidate anything signed with the old key. - Hunt. Review web logs for traversal requests to the BetterImageGallery image handler and any suspicious ViewState/deserialization activity.
- Reduce exposure. Where feasible, place the admin surface behind trusted networks.
- Confirm your exposure first. Verify whether you run mojoPortal and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing mojoPortal sites from little more than your domain, fingerprints the platform, and flags exposure tied to this flaw. We detect and prioritize the exposed, affected instance rather than exploiting it — and because the practical risk here is the leaked machine key rather than the file read alone, surfacing the exposed instance early is what lets you rotate keys before a disclosure becomes an execution.