CVE-2025-27022 Path Traversal Vulnerability in Infinera G42

High 7.5 Published 2 Jul 2025 Updated 2 Jul 2025

Remote authenticated users can download all OS files via HTTP requests due to insufficient input validation in the WebGUI.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-27022?

CVE-2025-27022 is a high-severity path traversal vulnerability in Infinera G42, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests.

Details:

Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.

Weakness: CWE-22

Which versions are affected by CVE-2025-27022?

It affects 1 product.

Products include Nokia G42 Firmware.

How do I fix CVE-2025-27022?

No fix has been published for CVE-2025-27022 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-27022 being exploited?

There is no known exploitation of CVE-2025-27022 in the wild and no public exploit code.

Sources

Also known as GHSA-g7cx-36jq-75p8.