CVE-2025-41714CWE-22

Path Traversal via 'Upload-Key' in SmartEMS Upload Handling

High · published September 10, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00709 · 53.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-10T06:48Z
EPSS history
Timeline
  • 10 SEP 06:48Z
    Path Traversal via 'Upload-Key' in SmartEMS Upload Handling
    cvelistv5