CVE-2022-25511 Path traversal in FreeTAKServer-UI
Attackers can upload arbitrary files to any system location via the filename parameter in the DataPackageTable route.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25511?
CVE-2022-25511 is a medium-severity path traversal vulnerability in n/a, published on 10 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
Which versions are affected by CVE-2022-25511?
3 open source packages ship an affected version, including freetakserver-ui and FreeTAKServer-UI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
freetakserver-ui PyPI | All versions to 1.9.8 | None |
freetakserver-ui PyPI | All versions to 1.9.8 | None |
FreeTAKServer-UI PyPI | All versions to 1.9.8 | None |
Products include Freetakserver-Ui Project Freetakserver-Ui.
How do I fix CVE-2022-25511?
No fix has been published for CVE-2022-25511 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-25511 being exploited?
There is no known exploitation of CVE-2022-25511 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-25510 Hard coded credentials in FreeTAKServer
- CVE-2022-25508 Improper Authentication in FreeTAKServer
- CVE-2022-25512 Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
- CVE-2022-25506 SQL Injection in FreeTAKServer-UI
- CVE-2022-25507 Cross-site Scripting in FreeTAKServer-UI
Sources
Also known as GHSA-7cr9-rmqr-fpqp, PYSEC-2026-637.