CVE-2025-41723
Published: 22 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-41723 is a directory traversal vulnerability in the importFile SOAP method, enabling an unauthenticated remote attacker to bypass path restrictions and upload files to arbitrary locations on the affected system. Published on 2025-10-22 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it is associated with CWE-35 (Path Traversal).
An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows arbitrary file uploads, potentially leading to high confidentiality, integrity, and availability impacts, such as overwriting critical files or deploying malicious payloads.
For mitigation details, refer to the vendor advisory at https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a directory traversal in a public-facing SOAP web service (importFile method), enabling unauthenticated remote arbitrary file uploads, which directly maps to exploitation of public-facing applications.