CVE-2025-34176

Katalog CVE

CVSS 4.3 · Medium EPSS 16,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada pfsense. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.

Rincian

Terbit di NVD

9 September 2025

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

16,0% peluang dieksploitasi; lebih tinggi dari 96,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 patch
• https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure advisory pihak ketiga
• https://redmine.pfsense.org/issues/16414 issue tracking