CVE-2025-0111 Palo Alto Networks PAN-OS File Read

Exploited in the wild High 7.1 Published 12 Feb 2025 Updated 26 Feb 2026

An authenticated attacker can read arbitrary files on the PAN-OS filesystem via the management web interface, exposing sensitive data.

Exploited in the wild: Since 20 Feb 2025
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-0111?

CVE-2025-0111 is a high-severity path traversal vulnerability in Paloaltonetworks Pan-Os, published on 12 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.

Weakness: CWE-610, CWE-73

Which versions are affected by CVE-2025-0111?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2025-0111?

No fix has been published for CVE-2025-0111 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 13 Mar 2025.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-0111 being exploited?

Yes. Attackers have exploited CVE-2025-0111 in the wild since at least 20 Feb 2025.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-wmcv-pj3g-38rp.