EVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal. The /api/export interface allows authenticated users to export lab files. This interface lacks effective input validation and filtering when processing file path parameters submitted by users.
References
| Link | Resource |
|---|---|
| https://github.com/XunMInt/cve/blob/main/EVE-NG_20251207.md | Exploit Third Party Advisory |
Configurations
History
02 Jan 2026, 16:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:eve-ng:eve-ng:6.4.0-13:*:*:*:professional:*:*:* | |
| First Time |
Eve-ng
Eve-ng eve-ng |
|
| References | () https://github.com/XunMInt/cve/blob/main/EVE-NG_20251207.md - Exploit, Third Party Advisory |
19 Dec 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-19 16:15
Updated : 2026-01-02 16:57
NVD link : CVE-2025-67442
Mitre link : CVE-2025-67442
CVE.ORG link : CVE-2025-67442
JSON object : View
Products Affected
eve-ng
- eve-ng
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')