CVE-2025-11079 is a medium severity (CVSS 5.3) information exposure flaw in Campcodes Farm Management System 1.0. Remote visitors can see file and directory information. The record lists no fixed release, so limit access to the app, check what your web root exposes, and ask the vendor about a patch.
What's affected
The record names Campcodes Farm Management System 1.0 and says the affected functionality is unknown. NVD scores it 5.3 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which is network reachable with a limited confidentiality impact and nothing else. Weakness classes: CWE-200, CWE-22, CWE-538.
No fixed version is listed. Because the record does not name a file, you have to look at what your own deployment exposes.
How to check if you're exposed
Look at what your web server returns for the application folders. Test whether directory listings are on, and whether backup or config files are served from the web root.
find /var/www -type f ( -name '*.bak' -o -name '*.sql' -o -name '*.zip' -o -name '*.log' ) 2>/dev/null
Change the path to your actual document root. Anything that turns up there and is reachable by URL is worth moving out of the web root.
What to do now
- Restrict who can reach the application, with a VPN or IP allow list.
- Turn off directory listing in the web server configuration.
- Move backups, logs and exports out of the web root.
- Ask the vendor for a patched version and watch the NVD record for updates.
- If the app is a demo or unused, take it offline.
Why it matters
Information exposure bugs are quiet. They do not let anyone change data, but they hand over a map of the system: file names, folders and sometimes backups. That map makes later attacks cheaper. The weaknesses here are CWE-200, CWE-22 and CWE-538.
The score is medium for that reason. Treat it as a prompt to review what your web root serves, not as a reason to panic. The exploit is described as public in the record, so a quick review is cheap insurance, and the vendor page is worth watching for a patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this let someone change data?
The record scores the impact on integrity and availability as none. The concern is exposed information.
Where should I start?
List what your web root serves, turn off directory listing, and move backups and logs out of it.
Sources
- NVD record for CVE-2025-11079
- Reference listed in the record
- Reference listed in the record
- Safeguard Gold page for CVE-2025-11079
Last reviewed: 19 October 2026.
