CVE-2025-59976 Junos Space: Arbitrary file download vulnerability in web interface

What is CVE-2025-59976?

CVE-2025-59976 is a high-severity path traversal vulnerability in Juniper Junos Space, published on 9 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.

Weakness: CWE-552

Which versions are affected by CVE-2025-59976?

It affects 1 product.

Products include Juniper Junos Space.

How do I fix CVE-2025-59976?

No fix has been published for CVE-2025-59976 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-59976 being exploited?

There is no known exploitation of CVE-2025-59976 in the wild and no public exploit code.

Other vulnerabilities in Juniper Junos Space

• CVE-2014-3412 Command injection in n/a Critical 10.0
• CVE-2014-3413 Hardcoded credentials in n/a Critical 9.8
• CVE-2016-1265 Junos Space: privilege escalation vulnerabilities in Junos Space Critical 9.8
• CVE-2017-10622 Junos Space: Authentication bypass vulnerability Critical 9.8
• CVE-2016-4926 Auth bypass in n/a Critical 9.8

All Juniper Junos Space vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-46gw-g4gv-v5gw.