CVE-2025-58590 Path traversal
Attackers can brute force folders and files to steal sensitive information from SICK analytics software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-58590?
CVE-2025-58590 is a medium-severity path traversal vulnerability in SICK AG Baggage Analytics, published on 6 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
Weakness: CWE-22
Which versions are affected by CVE-2025-58590?
It affects 4 products.
Products include Sick Baggage Analytics, Sick Logistic Diagnostic Analytics, Sick Package Analytics, Sick Tire Analytics.
How do I fix CVE-2025-58590?
No fix has been published for CVE-2025-58590 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-58590 being exploited?
There is no known exploitation of CVE-2025-58590 in the wild and no public exploit code.
Other vulnerabilities in SICK AG Baggage Analytics
- CVE-2025-49184 Information disclosure to unauthorized user
- CVE-2025-58587 Improper Restriction of Excessive Authentication Attempts
- CVE-2025-58591 Path Traversal
- CVE-2025-58579 Username Disclosure Through Missing Authentication
- CVE-2025-58584 Plain Text Transmission of Username and Password in the URL
Sources
Also known as GHSA-mq7g-4ph7-xx79.