CVE-2025-46363 Path traversal in Secure Connect Gateway SCG 5.0 Application and Appliance

Medium 4.3 Published 30 Oct 2025 Updated 30 Oct 2025

A low-privileged attacker can exploit a relative path traversal in the SCG REST API to access restricted resources if the API is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-46363?

CVE-2025-46363 is a medium-severity path traversal vulnerability in Dell Secure Connect Gateway, published on 30 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG exposed for an internal collection download REST API (if this REST API is enabled by Admin user from UI). A low privileged attacker with remote access could potentially exploit this vulnerability, leading to allowing relative path traversal to restricted resources.

Weakness: CWE-22, CWE-23

Which versions are affected by CVE-2025-46363?

It affects 1 product.

Products include Dell Secure Connect Gateway.

How do I fix CVE-2025-46363?

No fix has been published for CVE-2025-46363 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-46363 being exploited?

There is no known exploitation of CVE-2025-46363 in the wild and no public exploit code.

All Dell Secure Connect Gateway vulnerabilities

Sources

Also known as GHSA-hxw6-3gmw-qjx9.