CVE-2025-5468
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-08-12
Last updated on: 2025-09-23
Assigner: ivanti
Description
Description
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ivanti | connect_secure | to 22.7 (exc) |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | policy_secure | to 22.7 (exc) |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | zero_trust_access_gateway | 22.8 |
| ivanti | neurons_for_secure_access | to 22.8 (exc) |
| ivanti | neurons_for_secure_access | 22.8 |
| ivanti | neurons_for_secure_access | 22.8 |
| ivanti | neurons_for_secure_access | 22.8 |
| ivanti | neurons_for_secure_access | 22.8 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves improper handling of symbolic links in certain versions of Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access. It allows a local authenticated attacker to read arbitrary files on the disk by exploiting this flaw.
How can this vulnerability impact me? :
An attacker with local authenticated access could exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive information and compromising confidentiality.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70