CVE-2025-40629
Published: 16 May 2025
Summary
CVE-2025-40629 is a high-severity Path Traversal (CWE-22) vulnerability in Incibe (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 18.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
PNETLab version 4.2.10 contains a path traversal vulnerability arising from insufficient sanitization of user-supplied input in its file access mechanisms. The flaw, tracked as CWE-22, permits crafted HTTP requests to reference files outside the application's intended directory boundaries and carries a CVSS 4.0 score of 8.7 reflecting network attack vector, no required privileges or user interaction, and high confidentiality impact.
An unauthenticated remote attacker can exploit the issue by manipulating file paths within HTTP requests to retrieve sensitive files stored on the server. Successful exploitation yields read access to arbitrary files without affecting integrity or availability.
An advisory published by INCIBE on the referenced URL details the path traversal vulnerability affecting PNETLab. The EPSS score remains low at 0.0158 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15442
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the…
more
intended directory.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.