CVE-2025-34118

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/', '/chs/', or '/cht/', where the 'js/lang_en_us.js' or equivalent files are loaded. By injecting encoded traversal sequences such as '%c0%ae%c0%ae' into the request path, attackers can bypass input validation and disclose sensitive files.

CVSS

No CVSS.

References

Link	Resource
http://www.linknat.com/
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linknat_vos_traversal.rb
https://web.archive.org/web/20151013001957/http://www.wooyun.org/bugs/wooyun-2010-0145458
https://www.vulncheck.com/advisories/linknat-vos-manager-path-traversal-file-disclosure

Configurations

No configuration.

History

17 Jul 2025, 21:15

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de path traversal en versiones de Linknat VOS Manager anteriores a la 2.1.9.07, incluyendo VOS2009 y versiones anteriores de VOS3000, que permite a atacantes remotos no autenticados leer archivos arbitrarios en el servidor. La vulnerabilidad es accesible a través de múltiples subrutas localizadas como '/eng/', '/chs/' o '/cht/', donde se cargan los archivos 'js/lang_en_us.js' o equivalentes. Al inyectar secuencias de recorrido codificadas como '%c0%ae%c0%ae' en la ruta de solicitud, los atacantes pueden eludir la validación de entrada y divulgar archivos confidenciales.

16 Jul 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-16 21:15

Updated : 2025-07-17 21:15

NVD link : CVE-2025-34118

Mitre link : CVE-2025-34118

CVE.ORG link : CVE-2025-34118

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-34118", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-16T21:15:26.697", "references": [{"url": "http://www.linknat.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linknat_vos_traversal.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20151013001957/http://www.wooyun.org/bugs/wooyun-2010-0145458", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/linknat-vos-manager-path-traversal-file-disclosure", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/', '/chs/', or '/cht/', where the 'js/lang_en_us.js' or equivalent files are loaded. By injecting encoded traversal sequences such as '%c0%ae%c0%ae' into the request path, attackers can bypass input validation and disclose sensitive files."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en versiones de Linknat VOS Manager anteriores a la 2.1.9.07, incluyendo VOS2009 y versiones anteriores de VOS3000, que permite a atacantes remotos no autenticados leer archivos arbitrarios en el servidor. La vulnerabilidad es accesible a trav\u00e9s de m\u00faltiples subrutas localizadas como '/eng/', '/chs/' o '/cht/', donde se cargan los archivos 'js/lang_en_us.js' o equivalentes. Al inyectar secuencias de recorrido codificadas como '%c0%ae%c0%ae' en la ruta de solicitud, los atacantes pueden eludir la validaci\u00f3n de entrada y divulgar archivos confidenciales."}], "lastModified": "2025-07-17T21:15:50.197", "sourceIdentifier": "disclosure@vulncheck.com"}