CVE-2025-52022: Aptsys gemscms and gemsloyalty information disclosure via verbose error messages

CVE-2025-52022 · Severity: medium · CVSS 5.3 · Published 2026-01-23

Aptsys gemscms and gemsloyalty, which are backend platforms used for Point of Sale (POS) and loyalty programs, contain a vulnerability that exposes sensitive internal system information. By sending specifically crafted requests to the system, an unauthorized person can view technical details such as file paths, code snippets, and server error logs. This information does not directly grant access to customer data but provides a roadmap that attackers can use to plan more sophisticated attacks against the business.

Technologies: Aptsys Gemscms Backend. Vendors: Aptsys.

Quick answers

Is CVE-2025-52022 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-52022 being exploited in the wild.
How severe is CVE-2025-52022?
Medium severity, with a CVSS score of 5.3, published 23 January 2026.
Which products and versions are affected?
Aptsys Gemscms Backend thru 2025-05-28; Aptsys GemsLoyalty Backend thru 2025-05-28.
Is there a fix for CVE-2025-52022?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-52022 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-52022?
Check whether you run Aptsys Gemscms Backend or Aptsys GemsLoyalty Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The PHP backend for Aptsys gemscms and gemsloyalty platforms fails to properly suppress verbose error reporting on public API endpoints. An unauthenticated remote attacker can trigger unhandled exceptions by sending malformed HTTP GET or POST requests. These exceptions result in the generation of error messages containing sensitive information, including internal server file paths, stack traces, and fragments of PHP code (CWE-209). This information disclosure aids in reconnaissance for further exploitation, such as identifying specific software versions or vulnerable code patterns. As of the advisory date, the vendor has not acknowledged the issue or provided a patch.

Affected products

  • Aptsys gemscms backend thru 2025-05-28
  • Aptsys gemsloyalty backend thru 2025-05-28

Timeline

  • 2025-05-28: disclosed: Vulnerability discovered during normal application usage.
  • 2026-01-23: advisory: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.