CVE-2025-59099

The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service.

CVSS

No CVSS.

References

Link	Resource
https://r.sec-consult.com/dkaccess
https://r.sec-consult.com/dormakaba
https://www.dormakabagroup.com/en/security-advisories

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El Gestor de Acceso está utilizando el servidor web de código abierto CompactWebServer escrito en C#. Este servidor web está afectado por una vulnerabilidad de salto de ruta, que permite a un atacante acceder directamente a archivos mediante simples solicitudes GET sin autenticación previa. Por lo tanto, es posible recuperar todos los archivos almacenados en el sistema de archivos, incluyendo la base de datos SQLite Database.sq3, que contiene información de credenciales y los códigos PIN correspondientes. Además, al intentar acceder a ciertos archivos, el servidor web falla y se vuelve inalcanzable durante aproximadamente 60 segundos. Esto puede ser explotado para enviar continuamente la solicitud y causar denegación de servicio.

26 Jan 2026, 10:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-26 10:16

Updated : 2026-04-15 00:35

NVD link : CVE-2025-59099

Mitre link : CVE-2025-59099

CVE.ORG link : CVE-2025-59099

JSON object : View

Products Affected

No product.

CWE

CWE-35

Path Traversal: '.../...//'

{"id": "CVE-2025-59099", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-26T10:16:07.580", "references": [{"url": "https://r.sec-consult.com/dkaccess", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/dormakaba", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://www.dormakabagroup.com/en/security-advisories", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-35"}]}], "descriptions": [{"lang": "en", "value": "The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. \n\nHence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service."}, {"lang": "es", "value": "El Gestor de Acceso est\u00e1 utilizando el servidor web de c\u00f3digo abierto CompactWebServer escrito en C#. Este servidor web est\u00e1 afectado por una vulnerabilidad de salto de ruta, que permite a un atacante acceder directamente a archivos mediante simples solicitudes GET sin autenticaci\u00f3n previa. Por lo tanto, es posible recuperar todos los archivos almacenados en el sistema de archivos, incluyendo la base de datos SQLite Database.sq3, que contiene informaci\u00f3n de credenciales y los c\u00f3digos PIN correspondientes. Adem\u00e1s, al intentar acceder a ciertos archivos, el servidor web falla y se vuelve inalcanzable durante aproximadamente 60 segundos. Esto puede ser explotado para enviar continuamente la solicitud y causar denegaci\u00f3n de servicio."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}