CVE-2025-34238 Path traversal in WebAccess/VPN

Medium 6.9 Published 6 Nov 2025 Updated 17 Nov 2025

An authenticated network administrator can exploit a path traversal vulnerability to read arbitrary files accessible by the web user.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-34238?

CVE-2025-34238 is a medium-severity path traversal vulnerability in Advantech WebAccess/VPN, published on 6 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.

Weakness: CWE-22

Which versions are affected by CVE-2025-34238?

It affects 1 product.

Products include Advantech Webaccess\/Vpn.

How do I fix CVE-2025-34238?

No fix has been published for CVE-2025-34238 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-34238 being exploited?

There is no known exploitation of CVE-2025-34238 in the wild and no public exploit code.

Sources

Also known as GHSA-mhv6-73gf-63qx.