Path traversal in Endpoint Manager - #VU116836
Published: October 8, 2025
Vulnerability identifier: #VU116836
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within the implementation of the OnSaveToDB method. A remote attacker can trick a victim to open a specilly crafted file and upload arbitrary files on the system, leading to arbitrary code execution.
Affected software
Endpoint Manager
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.