Product:
Serv-U
Summary
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-40549 |
Exploitation
To exploit this vulnerability, an attacker with administrative privileges can manipulate the path restrictions within the Serv-U application. By crafting specific requests that bypass the intended path restrictions, the attacker can gain unauthorized access to execute code in directories that should be restricted, leading to potential system compromise.
Affected Products
- Serv-U: Affected by the path restriction bypass vulnerability, allowing code execution if exploited by an admin user.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure they are running the latest version of Serv-U and review their administrative access controls. Limiting administrative privileges and monitoring for unusual activity can also help reduce the risk of exploitation.