CVE-2025-26349

High

A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an…

Nozomi·CWE-23·Published 2025-02-12

CVSS

7.2

EPSS

0.03

KEV

Exploits

cve.orgen

214 chars

A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.

NVDen

214 chars

NVDes

240 chars

Un CWE-23 "Relative Path Traversal" en el mecanismo de carga de archivos en Q-Free MaxTime menor o igual a la versión 2.11.0 permite a un atacante remoto autenticado sobrescribir archivos arbitrarios a través de solicitudes HTTP manipulado.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	7.2	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	NVD	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H