CVE-2025-12382CWE-22path-traversal

CVE-2025-12382

High · published November 12, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

⚡ A crafty user could exploit a path traversal vulnerability in Algosec Firewall Analyzer to upload files where they shouldn't—think of it as someone sneaking into the back room of a restaurant! 🍽️ This vulnerability is like a delivery driver who misreads the address and ends up dropping off packages in the back office instead of the loading dock. It allows an attacker, once authenticated, to access restricted directories and upload malicious files. This could lead to code injection, allowing attackers to execute commands on the server—a potentially devastating breach! Imagine the chaos if an attacker could run scripts that manipulate firewall rules or steal sensitive data. Your defenses could crumble under such a targeted assault!

Put simply

This vulnerability is like a delivery driver who misreads the address and ends up dropping off packages in the back office instead of the loading dock. It allows an attacker, once authenticated, to access restricted directories and upload malicious files. The vulnerability in Algosec Firewall Analyzer stems from improper limitations on pathname handling, enabling an authenticated user to perform path traversal and upload files to restricted directories.

What to do

This could lead to code injection, allowing attackers to execute commands on the server—a potentially devastating breach! Imagine the chaos if an attacker could run scripts that manipulate firewall rules or steal sensitive data. Your defenses could crumble under such a targeted assault! To mitigate this vulnerability, immediately update Algosec Firewall Analyzer to versions A33.0 build 321 or A33.10 build 211 or later. Additionally, review access controls and ensure proper validation of uploaded files to prevent unauthorized uploads. You've got this! 😄 Stay proactive, and with these updates, you'll keep your environment secure. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00515 · 43.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-11-12T15:15Z
Affected products (4)
ProductVersionsFixed in
algosec/firewall_analyzerall versions—
algosec/firewall_analyzerall versions—
algosec/firewall_analyzerall versions—
algosec/firewall_analyzerall versions—
References (1)
EPSS history
Timeline
  • 12 NOV 09:37Z
    Path Traversal Allows Remote Code Execution in AlgoSec Firewall Analyzer
    cvelistv5