CVE-2025-26355

Medium

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an…

Nozomi·CWE-35·Published 2025-02-12

CVSS

6.5

EPSS

0.01

KEV

Exploits

cve.orgen

210 chars

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.

NVDen

210 chars

NVDes

230 chars

Un CWE-35 "Path Traversal" en maxtime/api/database/database.lua en Q-Free MaxTime menor o igual a la versión 2.11.0 permite a un atacante remoto autenticado eliminar archivos confidenciales a través de solicitudes HTTP manipulado.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	6.5	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
3.1	Secondary	NVD	6.5	1.2	5.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H