CVE-2025-53880
BaseFortify
Publication date: 2025-10-30
Last updated on: 2025-10-30
Assigner: SUSE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| suse | suse_manager | 4.3 |
| suse | suse_manager | 5.x |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-35 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Path Traversal issue in the tftpsync/add and tftpsync/delete scripts. It allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint does not require authentication, access is limited to a list of allowed IP addresses.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can write or delete files on the affected system with the permissions of the wwwrun user. This could lead to unauthorized modification or removal of files, potentially disrupting services or compromising system integrity.