Cyber Resilience

CVE-2025-54769

Xorux Lpar2Rrd ≤ 8.04

Public PoC
Published
29 July 2025
Modified
17 June 2026
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.030 86th percentile
Risk Priority 73 floored blend · peak EPSS

Summary

CVE-2025-54769 is a high-severity Path Traversal: '../filedir' (CWE-24) vulnerability in Xorux Lpar2Rrd. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-54769 is a path traversal vulnerability affecting an application that permits file uploads and relies on Perl modules. An authenticated read-only user can combine an upload with directory traversal to write an arbitrary file to any location on the server, including locations that overwrite existing Perl modules.

An attacker with read-only credentials can exploit the flaw over the network without user interaction to place a malicious module that the application subsequently loads, resulting in remote code execution with impacts on confidentiality, integrity, and availability. The CVSS 3.1 base score of 8.8 reflects the low attack complexity and the privilege escalation from read-only to full system control.

Public advisories referenced at korelogic.com, lpar2rrd.com, and seclists.org detail the issue and are the primary sources for patch or configuration guidance. The associated EPSS score has remained flat at 0.0934 with no material increase since disclosure.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote…

more

code execution (RCE) by an attacker.

CWE(s)
CWE-24CWE-434CWE-648

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
T1548.001 Setuid and Setgid Privilege Escalation
An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-54768Same product: Xorux Lpar2Rrd
CVE-2025-54767Same product: Xorux Lpar2Rrd
CVE-2025-54765Same vendor: Xorux
CVE-2025-54766Same vendor: Xorux
CVE-2023-1800Shared CWE-24, CWE-434
CVE-2023-20040Shared CWE-434
CVE-2023-34394Shared CWE-434
CVE-2023-31946Shared CWE-434
CVE-2023-25922Shared CWE-434
CVE-2024-49216Shared CWE-434

Affected Assets

xorux
lpar2rrd
≤ 8.04

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V5.1.1
  • V3.5.2
  • V6.4.6

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover incorrect calls to privileged APIs before deployment.

SI-10 Information Input Validation good match

Input validation directly neutralizes '../' sequences in externally-supplied pathnames before they are resolved.

SI-3 Malicious Code Protection good match

Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.

AC-3 Access Enforcement partial match

Enforced access authorizations can limit the damage even when path traversal succeeds.

AC-6 Least Privilege partial match

Least-privilege assignment directly reduces both the availability of privileged APIs and the blast radius when they are invoked incorrectly.

CM-7 Least Functionality partial match

Least functionality restricts the file types and automatic processing capabilities the system will accept.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-05 mostly match
prevents

Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and path sanitization that prevent ../ traversal.

PR.PS-01 partial match
prevents

Hardened configuration baselines can enforce allowed file types and processing rules.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match
prevents

Secure coding standards require neutralizing ../ sequences and canonicalizing paths before file operations.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches path-traversal flaws before release.

A.8.18 Use of privileged utility programs partial match
degrades

Restricting privileged utility programs limits the exposure of privileged APIs to misuse.

A.8.2 Privileged access rights partial match
degrades

Privileged access rights directly govern the correct use of privileged APIs and reduce misuse.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates input validation and path canonicalization that directly block ../ traversal.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for controls against path traversal in file-handling functions.

References