What is the CVSS score of CVE-2019-25355?

CVE-2019-25355 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 2.0%.

Which versions of Gsoap are affected by CVE-2019-25355?

CVE-2019-25355 is a directory traversal vulnerability in gSOAP 2.8 that allows unauthenticated attackers to access sensitive system files through manipulated HTTP requests.

Is there a public PoC exploit available for CVE-2019-25355?

Yes, a public proof-of-concept exploit is available for CVE-2019-25355. Prioritise patching immediately. EPSS: 2.0%.

How to fix or mitigate CVE-2019-25355?

Within 24 hours: Identify all systems running gSOAP 2.8 through asset inventory and network scanning; implement temporary WAF rules to block path traversal patterns (../, ..\, encoded variants). Within 7 days: Restrict network access to affected gSOAP services using firewall rules; require authentication/IP whitelisting where possible; monitor access logs for exploitation attempts. Within 30 days: Upgrade gSOAP to a patched version (2.8.x with security updates or newer); conduct forensic review of access logs to determine if compromise occurred; apply compensating controls until upgrade completion.

Gsoap CVE-2019-25355

HIGH

Path Traversal (CWE-22)

2026-02-18 disclosure@vulncheck.com

Path Traversal Gsoap Suse Genivia

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 22:29 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP path traversal techniques. Attackers can retrieve sensitive files like /etc/passwd by sending crafted GET requests with multiple '../' directory traversal sequences.

AnalysisAI

gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP path traversal techniques. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Gsoap. gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP path traversal techniques. Attackers can retrieve sensitive files like /etc/passwd by sending crafted GET requests with multiple '../' directory traversal sequences.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.