Cyber Posture

CVE-2025-26349

High

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
—
Patch
—
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0047 64.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may modify host software binaries to establish persistent access to systems.

Security Summary

CVE-2025-26349 is a CWE-23 Relative Path Traversal vulnerability in the file upload mechanism of Q-Free MaxTime versions less than or equal to 2.11.0. Published on 2025-02-12T14:15:34.960, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The issue enables an authenticated remote attacker to overwrite arbitrary files through crafted HTTP requests.

An attacker requires high privileges (PR:H) to exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows overwriting arbitrary files, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U).

Mitigation details are available in the advisory published by Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26349.

Details

CWE(s)
CWE-23

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1554 Compromise Host Software Binary Persistence
Adversaries may modify host software binaries to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Path traversal in file upload enables arbitrary file overwrites, facilitating ingress tool transfer (T1105), exploitation of public-facing app (T1190), web shell deployment (T1505.003), and binary compromise (T1554).

References