VulnerabilityDeferred

CVE-2025-40629

This allows attackers to perform directory traversal by manipulating file paths in HTTP requests.

HIGH 8.7EPSS 0.81%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.81% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: cve-coordination@incibe.es

References

https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-pnetlab

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.