CVE-2018-25311CWE-22

VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal

High · published April 29, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00596 · 47.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-29T19:25Z
EPSS history
Timeline
  • 29 APR 19:25Z
    VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal
    cvelistv5