CVE-2025-14728 Rapid7 Velociraptor Directory Traversal Vulnerability
A rogue client can write files outside the datastore directory on Linux servers due to insufficient sanitization of directory names ending with a dot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14728?
CVE-2025-14728 is a medium-severity path traversal vulnerability in Rapid7 Velociraptor, published on 29 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E".
Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.
Weakness: CWE-22
Which versions are affected by CVE-2025-14728?
It affects 1 product.
Products include Rapid7 Velociraptor.
How do I fix CVE-2025-14728?
No fix has been published for CVE-2025-14728 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-14728 being exploited?
There is no known exploitation of CVE-2025-14728 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Velociraptor
- CVE-2023-0242 Insufficient permission check in the VQL copy() function
- CVE-2023-5950 Rapid7 Velociraptor Reflected XSS
- CVE-2026-5329 Rapid7 Velociraptor Improper Input Validation in Client Message Handler
- CVE-2026-6290 Velociraptor Query() Plugin Misapplies Permissions To Orgs
- CVE-2022-35630 Unsafe HTML Injection in Artifact Collection Report
Sources
Also known as GHSA-fh4j-chp9-mvg5.