CVE-2025-4377 Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php
Attackers can read arbitrary files on the server via a path traversal flaw in the logview.php script of Sparx Pro Cloud Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4377?
CVE-2025-4377 is a high-severity path traversal vulnerability in Sparx Systems Pro Cloud Server, published on 9 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.
This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.
Logview is accessible on Pro Cloud Server Configuration interface.
This issue affects Pro Cloud Server: earlier than 6.0.165.
Which versions are affected by CVE-2025-4377?
How do I fix CVE-2025-4377?
No fix has been published for CVE-2025-4377 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-4377 being exploited?
There is no known exploitation of CVE-2025-4377 in the wild and no public exploit code.
Sources
Also known as GHSA-48q2-hf73-8f5p.