CVE-2026-25866

Katalog CVE

CVSS 7.8 · High EPSS 0,19%

Kerentanan Unquoted Search Path or Element pada mobatek mobaxterm. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-428: Unquoted Search Path or Element

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mobaxterm.mobatek.net/download-home-edition.html advisory vendor
• https://www.vulncheck.com/advisories/mobaxterm-notepad-unquoted-service-path advisory pihak ketiga