What is the CVSS score of CVE-2019-25352?

CVE-2019-25352 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Windows are affected by CVE-2019-25352?

Crystal Live HTTP Server 6.01 contains a critical directory traversal vulnerability that allows attackers to access sensitive system files without authentication.

Is there a public PoC exploit available for CVE-2019-25352?

Yes, a public proof-of-concept exploit is available for CVE-2019-25352. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2019-25352?

Within 24 hours: Identify all systems running Crystal Live HTTP Server 6.01 and isolate affected instances from production networks if possible. Within 7 days: Implement WAF rules to block directory traversal patterns (../, encoded variants) and restrict HTTP requests to legitimate application paths; consider disabling the HTTP server if not business-critical. Within 30 days: Migrate to an alternative, actively maintained HTTP server solution or upgrade to a patched version if available from the vendor.

Windows CVE-2019-25352

HIGH

Path Traversal (CWE-22)

2026-02-18 disclosure@vulncheck.com

Windows Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 19, 2026 - 15:53 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulating URL path segments. Attackers can use multiple '../' sequences to navigate outside the web root and retrieve sensitive configuration files like Windows system files.

AnalysisAI

Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulating URL path segments. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-22 (Path Traversal). Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulating URL path segments. Attackers can use multiple '../' sequences to navigate outside the web root and retrieve sensitive configuration files like Windows system files.

Affected ProductsAI

Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulating URL pat

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.