CVE-2025-60949 in Census CSWeb

Summary

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.

Responsible

cisa-cg

Reservation

09/26/2025

Disclosure

03/24/2026

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
352593	Census CSWeb Configuration config information disclosure	200	Proof-of-Concept	Official fix	CVE-2025-60949