CVE-2025-54118: NamelessMC Information Disclosure Flaw

CVE-2025-54118 Overview

CVE-2025-54118 is an information disclosure vulnerability affecting NamelessMC, a free website software package for Minecraft servers. Versions prior to 2.2.4 expose sensitive information, including the absolute filesystem path of the source code, through a list parameter processed by the application's error handler. Unauthenticated remote attackers can trigger the flaw over the network without user interaction. The issue is tracked as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor and fixed in NamelessMC 2.2.4.

Critical Impact
Unauthenticated remote attackers can retrieve absolute source code paths and detailed error traces, providing reconnaissance data useful for chaining further attacks against the NamelessMC installation.

Affected Products

NamelessMC Nameless versions prior to 2.2.4
Component: namelessmc:nameless
Fixed release: NamelessMC 2.2.4

Discovery Timeline

2025-08-18 - CVE-2025-54118 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54118

Vulnerability Analysis

The vulnerability resides in NamelessMC's error handling routine in core/classes/Misc/ErrorHandler.php. When the application encounters a fatal error during an API-style request, the handler emits a plaintext response containing the error message, the absolute file path where the error occurred, the source line number, and the full exception stack trace. Because the handler runs before any authentication or debug-mode check, unauthenticated clients receive the same verbose diagnostics that should be reserved for developers.

An attacker supplying a crafted list parameter can force the code path into the plaintext error branch and harvest environment details. The exposed absolute path reveals the web root layout, deployment user, and installation directory. This information supports secondary attacks such as local file inclusion, path traversal, and targeted exploitation of other components once directory structure is known.

Root Cause

The root cause is a missing authorization check around detailed error output. The plaintext error branch printed exception data without first verifying whether the caller was permitted to view detailed diagnostics. The fix introduces a Debugging::canViewDetailedError() gate that suppresses trace output for unauthenticated requests.

Attack Vector

Attack traffic travels over HTTP or HTTPS to any NamelessMC endpoint that reaches the API error path. No credentials, tokens, or user interaction are required. The attacker submits a request with a malformed list parameter and reads the resulting error response.

php

// Security patch in core/classes/Misc/ErrorHandler.php
// If this is an API request, print the error in plaintext and dont render the whole error trace page
if (self::shouldUsePlainText()) {
    if (!Debugging::canViewDetailedError()) {
        // If we can't view the full error (i.e. not authenticated), show a simple message
        die('Fatal error during request');
    }

    die($error_string . ' in ' . $error_file . ' on line ' . $error_line . (!is_null($exception) ? PHP_EOL . $exception->getTraceAsString() : ''));
}

Source: NamelessMC patch commit 3b94eb5

Detection Methods for CVE-2025-54118

Indicators of Compromise

HTTP requests containing a suspicious or malformed list query parameter directed at NamelessMC endpoints.
Web server responses whose bodies contain absolute filesystem paths, PHP file names, or getTraceAsString style stack traces.
Repeated 200-series responses with Fatal error strings originating from a single external IP address.

Detection Strategies

Inspect web server and application logs for anomalous list parameter values combined with error responses.
Deploy web application firewall rules that flag outbound response bodies containing absolute PHP paths such as /var/www/ or C:\\.
Correlate reconnaissance patterns targeting NamelessMC URLs with subsequent path traversal or file inclusion attempts.

Monitoring Recommendations

Alert when NamelessMC installations return response bodies larger than expected for error paths.
Track unauthenticated requests generating PHP exception traces and route them to security review.
Monitor installed NamelessMC versions across the environment and flag any instance below 2.2.4.

How to Mitigate CVE-2025-54118

Immediate Actions Required

Upgrade all NamelessMC installations to version 2.2.4 or later, which introduces the Debugging::canViewDetailedError() gate.
Audit web server access logs for prior exploitation attempts referencing the list parameter.
Restrict administrative endpoints behind network-level ACLs until patching is complete.

Patch Information

The vulnerability is fixed by commit 3b94eb594dcbb1abc5524e41a0631df3ac95de8f, shipped in NamelessMC 2.2.4. Details are documented in the NamelessMC GHSA-cj37-8jqc-hv2w advisory.

Workarounds

Disable verbose PHP error output by setting display_errors = Off in php.ini for production hosts.
Route NamelessMC traffic through a reverse proxy that strips or rewrites response bodies containing filesystem paths.
Configure the web server to return a generic error page for HTTP 500 responses generated by the application.

bash

# Configuration example: harden PHP error exposure on production NamelessMC hosts
# /etc/php/8.x/fpm/php.ini
display_errors = Off
display_startup_errors = Off
log_errors = On
error_log = /var/log/php/nameless-error.log

# Reload PHP-FPM after applying the change
sudo systemctl reload php8.x-fpm