CVE-2025-13879 Directory traversal vulnerability in EfficientIP's SOLIDserver IPAM
Authenticated administrators can exploit a directory traversal flaw to list unauthorized directories and files outside the intended scope.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13879?
CVE-2025-13879 is a medium-severity path traversal vulnerability in SOLIDserver IPAM, published on 2 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories other than those to which the have authorized access using the 'directory' parameter in '/mod/ajax.php?action=sections/list/list'.For examplem setting the 'directory' parameter to '/' displays files outside the 'LOCAL:///' folder.
Weakness: CWE-22
Which versions are affected by CVE-2025-13879?
It affects 1 product.
Products include Efficientip Solidserver Ip Address Management.
How do I fix CVE-2025-13879?
No fix has been published for CVE-2025-13879 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-13879 being exploited?
There is no known exploitation of CVE-2025-13879 in the wild and no public exploit code.
Sources
Also known as GHSA-3cr9-fpp3-68j2.