CVE-2025-0332

CVE-2025-0332 is a path traversal vulnerability (CWE-22) in Progress Telerik UI for WinForms, affecting versions prior to 2025 Q1 (2025.1.211). The issue arises from improper limitation of a target path, which can enable the decompression of an archive's content into a restricted directory. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A local attacker can exploit this vulnerability with low attack complexity and no required privileges, but user interaction is necessary. By providing a malicious archive, the attacker can trick a user into decompressing it via the affected component, allowing arbitrary file placement in restricted directories and resulting in high impacts to confidentiality, integrity, and availability.

The Telerik knowledge base advisory at https://docs.telerik.com/devtools/winforms/knowledge-base/kb-security-path-traversal-cve-2025-0332 provides details on the issue, with mitigation achieved by updating to Telerik UI for WinForms 2025 Q1 (2025.1.211) or later.