CVE-2026-25825 Path traversal in n/a
An admin can write arbitrary files to the server filesystem via path traversal in SignServer, potentially overwriting existing files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25825?
CVE-2026-25825 is a low-severity path traversal vulnerability in n/a, published on 15 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin access) the possibility to write files in arbitrary directories in the server filesystem and potentially overwrite files accessible by the local user JBoss.
Weakness: CWE-706
Which versions are affected by CVE-2026-25825?
How do I fix CVE-2026-25825?
No fix has been published for CVE-2026-25825 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25825 being exploited?
There is no known exploitation of CVE-2026-25825 in the wild and no public exploit code.
Sources
Also known as GHSA-3fj7-29mr-x58f.