CVE-2025-26356

High

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0…

Nozomi·CWE-35·Published 2025-02-12

CVSS

7.2

EPSS

0.01

KEV

Exploits

cve.orgen

234 chars

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.

NVDen

234 chars

NVDes

252 chars

Un CWE-35 "Path Traversal" en maxtime/api/database/database.lua (setActive endpoint) en Q-Free MaxTime menor o igual a la versión 2.11.0 permite a un atacante remoto autenticado sobrescribir archivos confidenciales mediante solicitudes HTTP manipulado.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	7.2	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	NVD	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H