CVE-2025-14728

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14728", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2025-12-15T16:45:47.021Z", "datePublished": "2025-12-29T19:04:27.820Z", "dateUpdated": "2025-12-30T22:26:47.316Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Velociraptor", "repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "versions": [{"lessThan": "0.75.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>This vulnerability only occurs on Velociraptor server running on Linux (which is the common and recommended configuration). Velociraptor servers running on Windows are not affected.</p>\n\n\n\n\n<br>"}], "value": "This vulnerability only occurs on Velociraptor server running on Linux (which is the common and recommended configuration). Velociraptor servers running on Windows are not affected."}], "credits": [{"lang": "en", "type": "reporter", "value": "We thank @_chebuya for identifying and reporting this issue."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a \".\", only encoding the final \".\" AS \"%2E\".</p>\n<p>Although files can be written to incorrect locations, the containing directory must end with \"%2E\". This limits the impact of this vulnerability, and prevents it from overwriting critical files.</p>"}], "value": "Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a \".\", only encoding the final \".\" AS \"%2E\".\n\n\nAlthough files can be written to incorrect locations, the containing directory must end with \"%2E\". This limits the impact of this vulnerability, and prevents it from overwriting critical files."}], "impacts": [{"capecId": "CAPEC-23", "descriptions": [{"lang": "en", "value": "CAPEC-23 File Content Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2025-12-29T19:04:27.820Z"}, "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/"}], "source": {"discovery": "EXTERNAL"}, "title": "Rapid7 Velociraptor Directory Traversal Vulnerability", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-30T21:54:55.659289Z", "id": "CVE-2025-14728", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T22:26:47.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14728", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-30T21:54:55.659289Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T21:55:10.765Z"}}], "cna": {"title": "Rapid7 Velociraptor Directory Traversal Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "We thank @_chebuya for identifying and reporting this issue."}], "impacts": [{"capecId": "CAPEC-23", "descriptions": [{"lang": "en", "value": "CAPEC-23 File Content Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.75.6", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a \".\", only encoding the final \".\" AS \"%2E\".\n\n\nAlthough files can be written to incorrect locations, the containing directory must end with \"%2E\". This limits the impact of this vulnerability, and prevents it from overwriting critical files.", "supportingMedia": [{"type": "text/html", "value": "<p>Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a \".\", only encoding the final \".\" AS \"%2E\".</p>\n<p>Although files can be written to incorrect locations, the containing directory must end with \"%2E\". This limits the impact of this vulnerability, and prevents it from overwriting critical files.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "configurations": [{"lang": "en", "value": "This vulnerability only occurs on Velociraptor server running on Linux (which is the common and recommended configuration). Velociraptor servers running on Windows are not affected.", "supportingMedia": [{"type": "text/html", "value": "<p>This vulnerability only occurs on Velociraptor server running on Linux (which is the common and recommended configuration). Velociraptor servers running on Windows are not affected.</p>\n\n\n\n\n<br>", "base64": false}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2025-12-29T19:04:27.820Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14728", "state": "PUBLISHED", "dateUpdated": "2025-12-30T22:26:47.316Z", "dateReserved": "2025-12-15T16:45:47.021Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2025-12-29T19:04:27.820Z", "assignerShortName": "rapid7"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Velociraptor", "repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "versions": [{"lessThan": "0.75.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@rapid7.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DB5420C-F7CB-4A8E-87DE-5AC9A5AF14A5", "versionEndExcluding": "0.75.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a \".\", only encoding the final \".\" AS \"%2E\".\n\n\nAlthough files can be written to incorrect locations, the containing directory must end with \"%2E\". This limits the impact of this vulnerability, and prevents it from overwriting critical files."}, {"lang": "es", "value": "Las versiones de Rapid7 Velociraptor anteriores a la 0.75.6 contienen un problema de salto de directorio en servidores Linux que permite a un cliente malicioso cargar un archivo que se escribe fuera del directorio de almac\u00e9n de datos. Normalmente, Velociraptor solo tiene permitido escribir en el directorio de almac\u00e9n de datos. El problema ocurre debido a una sanitizaci\u00f3n insuficiente de los nombres de directorio que terminan con un '.', codificando solo el '.' final como '%2E'.\n\nAunque los archivos pueden escribirse en ubicaciones incorrectas, el directorio contenedor debe terminar con '%2E'. Esto limita el impacto de esta vulnerabilidad y evita que sobrescriba archivos cr\u00edticos."}], "id": "CVE-2025-14728", "lastModified": "2026-10-07T12:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "cve@rapid7.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14728", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-30T21:54:55.659289Z", "version": "2.0.3"}}]}, "published": "2025-12-29T19:15:55.277", "references": [{"source": "cve@rapid7.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{"created": "2026-01-05T10:23:18.515542+00:00", "updated": "2026-01-05T10:23:18.515571+00:00", "vendors": ["rapid7", "rapid7$PRODUCT$velociraptor"]}