# CVE-2025-52023: Aptsys GemsCMS information disclosure via verbose error messages

Source: https://junglewise.ai/threats/cve-2025-52023-aptsys-gemscms-information-disclosure-via-verbose-error-messages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-23. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-52023 · Severity: medium · CVSS 5.3 · Published 2026-01-23

Aptsys GemsCMS, a backend platform used for Point of Sale (POS) and restaurant management systems, contains a vulnerability that reveals sensitive internal technical information to the public. By sending specifically crafted requests, an unauthorized person can force the system to display detailed error messages including server file paths and snippets of the application's code. This information can be used by attackers to better understand the system's internal workings and plan more sophisticated attacks against the business.

Technologies: [Aptsys Gemscms Backend](https://junglewise.ai/threats/technologies/gemscms-backend). Vendors: [Aptsys](https://junglewise.ai/threats/vendors/aptsys).

## Quick answers

**Is CVE-2025-52023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-52023 being exploited in the wild.

**How severe is CVE-2025-52023?** Medium severity, with a CVSS score of 5.3, published 23 January 2026.

**Which products and versions are affected?** Aptsys Gemscms Backend thru 2025-05-28.

**Is there a fix for CVE-2025-52023?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-52023 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-52023?** Check whether you run Aptsys Gemscms Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Aptsys GemsCMS PHP backend is vulnerable to information disclosure (CWE-209) due to improper error handling on public API endpoints. Unauthenticated remote attackers can trigger unhandled exceptions by sending malformed HTTP GET or POST requests. These exceptions result in verbose PHP error messages that expose sensitive internal server data, including full file system paths, stack traces, and fragments of source code. This information significantly aids an attacker in reconnaissance for further exploits such as SQL injection or remote code execution. As of the disclosure date, the vendor has not released a patch.

## Affected products

- Aptsys GemsCMS Backend thru 2025-05-28

## Timeline

- 2025-05: disclosed: Vulnerability discovered by researcher
- 2025-05-28: other: End of affected version range identified in advisory
- 2025-07: other: CVE reserved
- 2025-11-18: advisory: Public disclosure via GitHub Gist
- 2026-01-23: other: CVE published to NVD

## References

- [http://gemscms.com/](http://gemscms.com/)
- [https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39](https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39)

## Related threats

- [Aptsys gemscms information disclosure in getCashiers endpoint](https://junglewise.ai/threats/cve-2025-52026-aptsys-gemscms-information-disclosure-in-getcashiers-endpoint)
- [Aptsys gemscms SQL injection in GetServiceByRestaurantID](https://junglewise.ai/threats/cve-2025-52025-aptsys-gemscms-sql-injection-in-getservicebyrestaurantid)
- [Aptsys gemscms POS Platform authentication bypass in Web Services module](https://junglewise.ai/threats/cve-2025-52024-aptsys-gemscms-pos-platform-authentication-bypass-in-web-services)
- [Aptsys gemscms and gemsloyalty information disclosure via verbose error messages](https://junglewise.ai/threats/cve-2025-52022-aptsys-gemscms-and-gemsloyalty-information-disclosure-via-verbose)