CVE-2025-48744 is a medium severity flaw (CVSS 6.4) in SIGB PMB, the library management software, in versions before 8.0.1.2. The record says attackers can achieve local file inclusion and remote code execution. The change log lists the fix in 8.0.1.2, so upgrade to that release or later.
What's affected
The CVE record says SIGB PMB before 8.0.1.2 is affected. The PMB change log for 8.0.1.2, dated 3 March 2025, lists security entries that match this CVE and the two related ones assigned at the same time: a fix for an SQL injection, a fix in the installer program that allowed remote code execution, and a fix for file inclusion that allowed remote code execution. Because the vector shows low privileges required, also review who holds accounts on the system.
PMB is a library management system published under the SIGB name. The change log shows many later releases, up to 8.0.1.29 dated 16 March 2026, so you can move well past 8.0.1.2. Plan the upgrade to the newest release the vendor supports for your setup.
How to check if you're exposed
Find where PMB is installed and which version it runs. Look for the version in your PMB administration screens, or in the installed files that your package or deployment records.
find / -type d -name "pmb" 2>/dev/null | head
If the installation is older than 8.0.1.2, you are in the affected range. Then check how it is exposed. PMB usually has a public catalogue (OPAC) and a staff back office. Ask which of these is reachable from the internet, and whether the installer is still reachable on a production system.
Look at your web server logs for requests to unusual PMB paths, and for database errors in the application log. The change log entry that matches this CVE reads as file inclusion and remote code execution. The CVSS vector in the record shows low privileges required, so an account on the system may be needed.
What to do now
- Identify every PMB instance, including old test copies, and record the version.
- Upgrade to the newest supported release, and at minimum 8.0.1.2. Back up the database and files first, and test local customisations.
- Restrict the back office and any setup or installer paths to the networks that need them, using your web server or firewall.
- As general hardening, remove or block installer scripts from a finished production installation if the vendor documentation allows it.
- Review logs and the file system for unexpected changes, and rotate database and admin passwords if you see signs of abuse.
Why it matters
The record lists the weakness as CWE-22, path traversal. The CVSS score is Medium, but the record text describes code execution in two of the three related issues, which is why this should not wait for a quiet period. A Medium score can be low because the attack needs unusual conditions, not because the result is mild.
The three CVEs were published together on 27 May 2025, after the fix shipped on 3 March 2025. That is the pattern to watch for: a fixed release can exist for months before the CVE appears, so scanners that only look at recent CVEs miss old installs. Search by product and version.
None of the three is listed in the CISA Known Exploited Vulnerabilities catalogue, and I found no statement of exploitation in the sources.
Quick check
Which version fixes this issue?
The record says versions before 8.0.1.2 are affected, and the PMB change log lists the security fixes in 8.0.1.2. Newer releases exist, so upgrade to the latest supported one.
Are the three PMB CVEs the same bug?
No. The change log lists three separate security entries, and the record gives each CVE its own weakness: SQL injection, an installer issue and file inclusion.
Sources
Last reviewed: 18 October 2026.
