CVE-2025-54769CWE-24CWE-434CWE-648

KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal

High · published July 28, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03397 · 88.8th percentile
Weaknesses
CWE-24 · Path Traversal: '../filedir'; CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-648 · Incorrect Use of Privileged APIs
Published
2025-07-28T23:34Z
EPSS history
Timeline
  • 28 JUL 23:34Z
    KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
    cvelistv5