CVE-2025-0926 Path traversal in AXIS Camera Station Pro

Medium 5.9 Published 23 Apr 2025 Updated 23 Apr 2025

A non-admin user can delete system files via file deletion redirection, causing a boot loop in AXIS Camera Station Pro.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-0926?

CVE-2025-0926 is a medium-severity path traversal vulnerability in AXIS Camera Station Pro, published on 23 Apr 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Weakness: CWE-732

Which versions are affected by CVE-2025-0926?

It affects 1 product.

Products include Axis Camera Station Pro.

How do I fix CVE-2025-0926?

No fix has been published for CVE-2025-0926 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-0926 being exploited?

There is no known exploitation of CVE-2025-0926 in the wild and no public exploit code.

Sources

Also known as GHSA-p2hm-hc2v-xwc6.