CVE-2025-26349
Published: 12 February 2025
Summary
CVE-2025-26349 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Q-Free Maxtime. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked in the top 35.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates file paths and filenames in upload requests to block relative path traversal exploits like CWE-23.
Remediates the specific path traversal flaw in Q-Free MaxTime's file upload mechanism through timely patching.
Verifies integrity of critical files to detect unauthorized overwrites from successful path traversal exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in file upload enables arbitrary file overwrites, facilitating ingress tool transfer (T1105), exploitation of public-facing app (T1190), web shell deployment (T1505.003), and binary compromise (T1554).
NVD Description
A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26349 is a CWE-23 Relative Path Traversal vulnerability in the file upload mechanism of Q-Free MaxTime versions less than or equal to 2.11.0. Published on 2025-02-12T14:15:34.960, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The issue enables an authenticated remote attacker to overwrite arbitrary files through crafted HTTP requests.
An attacker requires high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows overwriting arbitrary files, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U).
Mitigation details are available in the advisory published by Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26349.
Details
- CWE(s)