CVE-2019-25355 Genivia gSOAP 2.8 - 'gSOAP' Path Traversal
Unauthenticated attackers can read sensitive system files via directory traversal in gSOAP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25355?
CVE-2019-25355 is a high-severity path traversal vulnerability in Genivia Inc. gSOAP, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP path traversal techniques. Attackers can retrieve sensitive files like /etc/passwd by sending crafted GET requests with multiple '../' directory traversal sequences.
Weakness: CWE-22
Which versions are affected by CVE-2019-25355?
It affects 1 product.
Products include Genivia Gsoap.
How do I fix CVE-2019-25355?
No fix has been published for CVE-2019-25355 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-25355 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25355 exists.
Other vulnerabilities in Genivia Inc. gSOAP
Sources
Also known as GHSA-vh22-vqgf-cr4h, UBUNTU-CVE-2019-25355.