CVE-2025-25683

The vulnerability stems from an incorrect access control check in AlekSIS-Core's PDF file retrieval logic. The permission verification only activates when the requesting user has an associated person object; unauthenticated users, lacking a person, bypass the check entirely [2]. This allows them to access any PDF file stored in the system.

Exploitation is straightforward: an attacker triggers the generation of a PDF file (e.g., by submitting a form), observes the file's ID in the GraphQL response, and then enumerates adjacent IDs to retrieve other PDFs created within the last 24 hours [1]. No authentication or special privileges are required.

The impact is significant because the exposed PDFs may contain sensitive information such as substitution plans, class register printouts, or other documents generated by third-party apps [1]. Although files are automatically deleted after 24 hours, the window of exposure is sufficient for data harvesting.

AlekSIS has addressed the issue in the upcoming release 4.0.0 and backported fixes to versions 3.1.7 and 3.2.2. Users are advised to update their installations using the provided pip commands [1].