# CVE-2025-0632

## Summary

- **CVE ID:** CVE-2025-0632
- **Severity:** CRITICAL
- **CVSS Score:** 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:N)
- **CWE:** CWE-98, CWE-22
- **Published:** Apr 21, 2025
- **Last Modified:** Mar 13, 2026

## Description

Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.

This issue affects Rock Maker Web: from 3.2.1.1 and later

## Affected Products

- Formulatrix — Rock Maker Web (3.2.1.1)

## References

- [CNA](https://www.formulatrix.com/downloads/apps/repository/rockmaker/)
- [CNA](https://formulatrix.com/downloads/apps/repository/rockmaker/RockMaker%20V3/3.18/3.18.4.7/RockMakerWeb_3.18.4.7_setup.exe)
- [CNA](https://formulatrix.com/downloads/docs/cve/RockMaker/CVE-2025-0632_Security_Bulletin.pdf)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.85%
- **EPSS Percentile:** 56.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._