CVE-2026-25760 Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver

What is CVE-2026-25760?

CVE-2026-25760 is a medium-severity path traversal vulnerability in BishopFox sliver, published on 6 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.

Weakness: CWE-22

Which versions are affected by CVE-2026-25760?

3 open source packages ship an affected version, including github.com/bishopfox/sliver. It affects 1 product.

Products include Bishopfox Sliver.

How do I fix CVE-2026-25760?

Upgrade github.com/bishopfox/sliver to 1.6.11 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-25760 being exploited?

There is no known exploitation of CVE-2026-25760 in the wild and no public exploit code.

Other vulnerabilities in BishopFox sliver

• CVE-2023-34758 Silver vulnerable to MitM attack against implants due to a cryptography vulnerability High 8.1
• CVE-2026-25791 Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service High 7.5
• CVE-2025-27090 Server-Side Request Forgery (SSRF) in sliver teamserver Medium 6.9
• CVE-2026-34227 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface Medium 5.9
• CVE-2026-32941 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports Medium 5.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2286-hxv5-cmp2, GO-2026-4445.