Allegra CVE-2025-11466

Exploitation requires an authenticated session with high privileges (CVSS PR:H) on the target Allegra installation and access to the DatabaseBackupBL database-backup functionality; the attacker supplies a crafted, path-traversal-laden file path that the class fails to validate before file operations. Limiting factors: the high privilege requirement (an attacker must already possess an elevated/admin-level account), the confidentiality-only impact (no code execution, data modification, or availability loss), and the fact that disclosed files are limited to those readable by the service account. No user interaction is required (UI:N), and the vector is network-accessible (AV:N) once authenticated.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 3.0 base score of 4.9 (vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable but high-privilege-gated flaw: an attacker must already hold elevated (PR:H) authenticated access, which materially limits the exploitable population to insiders or attackers who have already compromised a privileged account. Impact is confidentiality-only (C:H, I:N, A:N), consistent with an information-disclosure path traversal (CWE-22). No EPSS score, SSVC decision, or KEV entry was supplied in the input, and there is no public exploit identified at time of analysis, so there is no evidence of active or at-scale exploitation. The disclosing party is Trend Micro ZDI (a coordinated-disclosure research source), which typically means a vendor-coordinated fix rather than in-the-wild abuse. Net assessment: a credible but low-to-moderate real-world risk - the high privilege requirement and lack of integrity/availability impact keep it well below critical, and the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the provided signals.

An authenticated user with high privileges on an Allegra instance invokes the database backup functionality and supplies a crafted file path containing directory-traversal sequences. Because DatabaseBackupBL does not validate the user-supplied path before performing file operations, the application reads and returns files outside the intended directory, disclosing sensitive data in the context of the service account. No public exploit code was identified in the provided data.