Executive Summary

CVE-2025-60786 is a Zip Slip vulnerability in the project import feature of iceScrum v7.54 Pro On-prem. It occurs because the software improperly sanitizes file paths when extracting user-uploaded ZIP files. Attackers can craft malicious ZIP archives containing directory traversal sequences (like "../") that allow files to be extracted outside the intended directory. This enables attackers to write arbitrary files anywhere on the server filesystem, potentially leading to remote code execution and other malicious actions. [1]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code on the server. Other impacts include tampering with configuration files, disrupting services, and exfiltrating sensitive data. Since iceScrum allows self-registration by default, any self-registered user can exploit this vulnerability via the import feature, increasing the risk and severity of attacks. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection can involve monitoring for attempts to upload ZIP files via the project import feature that contain directory traversal sequences such as "../" in file paths. Since the vulnerability involves extracting crafted ZIP files, inspecting uploaded ZIP archives for suspicious paths is key. Specific commands are not provided in the resources, but administrators can check uploaded ZIP contents manually or with scripts that scan for directory traversal patterns. Network monitoring for unusual POST requests to the import endpoint may also help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the official security patches provided by iceScrum for versions up to 7.5.4. If patches are not yet available, disabling the project import feature temporarily is recommended to prevent exploitation. Additionally, restricting self-registration or limiting access to the import functionality can reduce risk. [1]

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not specify how the CVE-2025-60786 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0