CVE-2025-4632 Samsung MagicINFO 9 Server Path Traversal

Exploited in the wild Critical 9.8 Published 13 May 2025 Updated 26 Feb 2026

Attackers can write arbitrary files with system privileges via path traversal in Samsung MagicINFO 9 Server, potentially leading to code execution.

Exploited in the wild: Since 22 May 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-4632?

CVE-2025-4632 is a critical path traversal vulnerability in Samsung Electronics MagicINFO 9 Server, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

Weakness: CWE-22

Which versions are affected by CVE-2025-4632?

It affects 1 product.

Products include Samsung Magicinfo 9 Server.

How do I fix CVE-2025-4632?

No fix has been published for CVE-2025-4632 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 12 Jun 2025.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-4632 being exploited?

Yes. Attackers have exploited CVE-2025-4632 in the wild since at least 22 May 2025.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-cmww-723f-496g.