CVE-2025-25652

In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

⚡ A sneaky directory traversal vulnerability hides in Eptura Archibus, letting anyone manipulate file paths! Think of it like a delivery driver who misreads the address and ends up in the wrong neighborhood, accessing files they absolutely shouldn’t be able to touch. This flaw lets attackers navigate outside intended directories, similar to a wayward delivery slipping through an open back gate! An attacker could exploit this to access sensitive files or execute unauthorized scripts—potentially leading to unauthorized data exposure or even system compromise. The implications are incredibly serious, as it could allow for a full compromise of the server if not addressed. 🔥

Put simply

Think of it like a delivery driver who misreads the address and ends up in the wrong neighborhood, accessing files they absolutely shouldn’t be able to touch. This flaw lets attackers navigate outside intended directories, similar to a wayward delivery slipping through an open back gate! The vulnerability arises in the "Run script" and "Server File" components of the "Database Update Wizard," where insufficient validation allows for directory traversal, enabling unauthorized file access and code execution.

What to do

An attacker could exploit this to access sensitive files or execute unauthorized scripts—potentially leading to unauthorized data exposure or even system compromise. The implications are incredibly serious, as it could allow for a full compromise of the server if not addressed. 🔥 Update to the latest version of Eptura Archibus immediately, ensuring that all future paths are correctly validated. Implement strict access controls and regularly audit file permissions to minimize the risk. 🛡️ You’ve got this! Follow the steps to patch up this vulnerability and keep your system safe! ✨

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00826 · 57.0th percentile
Published
2026-01-13T00:00Z
EPSS history
Timeline
  • 13 JAN 00:00Z
    In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal
    cvelistv5