CVE-2025-14728

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E". Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Rapid7 Velociraptor anteriores a la 0.75.6 contienen un problema de salto de directorio en servidores Linux que permite a un cliente malicioso cargar un archivo que se escribe fuera del directorio de almacén de datos. Normalmente, Velociraptor solo tiene permitido escribir en el directorio de almacén de datos. El problema ocurre debido a una sanitización insuficiente de los nombres de directorio que terminan con un '.', codificando solo el '.' final como '%2E'. Aunque los archivos pueden escribirse en ubicaciones incorrectas, el directorio contenedor debe terminar con '%2E'. Esto limita el impacto de esta vulnerabilidad y evita que sobrescriba archivos críticos.

Information

Published : 2025-12-29 19:15

Updated : 2026-10-07 12:10

NVD link : CVE-2025-14728

Mitre link : CVE-2025-14728

CVE.ORG link : CVE-2025-14728

JSON object : View

Products Affected

linux

linux_kernel

rapid7

velociraptor

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-14728", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14728", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-30T21:54:55.659289Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.75.6", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2025-12-29T19:15:55.277", "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@rapid7.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a \".\", only encoding the final \".\" AS \"%2E\".\n\n\nAlthough files can be written to incorrect locations, the containing directory must end with \"%2E\". This limits the impact of this vulnerability, and prevents it from overwriting critical files."}, {"lang": "es", "value": "Las versiones de Rapid7 Velociraptor anteriores a la 0.75.6 contienen un problema de salto de directorio en servidores Linux que permite a un cliente malicioso cargar un archivo que se escribe fuera del directorio de almac\u00e9n de datos. Normalmente, Velociraptor solo tiene permitido escribir en el directorio de almac\u00e9n de datos. El problema ocurre debido a una sanitizaci\u00f3n insuficiente de los nombres de directorio que terminan con un '.', codificando solo el '.' final como '%2E'.\n\nAunque los archivos pueden escribirse en ubicaciones incorrectas, el directorio contenedor debe terminar con '%2E'. Esto limita el impacto de esta vulnerabilidad y evita que sobrescriba archivos cr\u00edticos."}], "lastModified": "2026-10-07T12:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DB5420C-F7CB-4A8E-87DE-5AC9A5AF14A5", "versionEndExcluding": "0.75.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@rapid7.com"}