CVE-2025-59099
Path Traversal and DoS in CompactWebServer Access Manager
Publication date: 2026-01-26
Last updated on: 2026-01-26
Assigner: SEC Consult Vulnerability Lab
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | compactwebserver | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-35 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in the CompactWebServer used by the Access Manager. It allows an attacker to access files on the server's file system directly through simple GET requests without needing to authenticate first. This means sensitive files, including a SQLite database containing badge information and PIN codes, can be retrieved by an attacker. Additionally, attempting to access certain files causes the web server to crash and become unreachable for about 60 seconds, which can be exploited to cause a denial of service.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information, such as badge data and PIN codes stored in the SQLite database. It also allows attackers to cause denial of service by crashing the web server repeatedly, making the service unavailable for periods of time.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by monitoring for unauthorized GET requests attempting path traversal patterns, such as requests containing '../' sequences targeting sensitive files like Database.sq3. Additionally, observing repeated crashes or unavailability of the web server for about 60 seconds after certain file access attempts may indicate exploitation attempts. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the CompactWebServer to trusted networks, implementing network-level controls to block suspicious GET requests with path traversal patterns, and monitoring for denial of service attempts caused by repeated access to certain files. Applying patches or updates from the vendor once available is also recommended. Specific mitigation commands or patches are not provided in the available information.