Which versions of RIPS Scanner are affected by CVE-2025-34126?

RIPS Scanner 0.54 contains an unauthenticated remote file disclosure vulnerability (CVE-2025-34126, CVSS 8.7) enabling attackers to read arbitrary files accessible to the web server, with publicly…

Is there a public PoC exploit available for CVE-2025-34126?

Yes, a public proof-of-concept exploit is available for CVE-2025-34126. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate CVE-2025-34126?

Within 24 hours: Audit network exposure of all RIPS Scanner 0.54 instances and immediately disable public internet access; document version and location of each deployment. Within 7 days: Implement firewall rules restricting all access to internal networks only and deploy Web Application Firewall signatures to block directory-traversal payloads in the 'file' parameter of windows/code.php. Within 30 days: Monitor RIPS vendor advisories for patch availability and plan an upgrade strategy; review system logs and access patterns for indicators of exploitation or unauthorized file access.

RIPS Scanner CVE-2025-34126

Q: What is the CVSS score of CVE-2025-34126?

CVE-2025-34126 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.5%.

HIGH

Path Traversal (CWE-22)

2025-07-16 disclosure@vulncheck.com

Microsoft Path Traversal PHP

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable traversal (AV:N/AC:L/PR:N/UI:N) yielding arbitrary file read, so high confidentiality but no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 23:30 vuln.today

CVE Published

Jul 16, 2025 - 22:15 cve.org

HIGH 8.7

DescriptionCVE.org

A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the privileges of the web server by sending crafted HTTP GET requests to the 'windows/code.php' script with a manipulated 'file' parameter. This can lead to disclosure of sensitive information.

AnalysisAI

Arbitrary file disclosure in RIPS Scanner 0.54 lets remote unauthenticated attackers read any file readable by the web server by supplying a directory-traversal payload in the 'file' parameter of the 'windows/code.php' script. Publicly available exploit code exists, including a Metasploit auxiliary module (rips_traversal.rb) and Exploit-DB entry 18660, making trivial mass exploitation of exposed instances practical. Not listed in CISA KEV, so no confirmed active exploitation, but the low-complexity, no-auth network vector combined with ready-made tooling makes opportunistic use straightforward.

Technical ContextAI

RIPS Scanner is a legacy PHP-based static source-code analysis tool for finding vulnerabilities in PHP applications, distributed via SourceForge (rips-scanner.sourceforge.net). The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): the 'windows/code.php' helper takes a user-supplied 'file' parameter and uses it to build a filesystem path passed to a file-read/display routine without canonicalizing or constraining it to an intended base directory. By injecting sequences such as '../' (or absolute paths), an attacker escapes the intended web directory and reads arbitrary files with the privileges of the PHP/web-server process. Because RIPS itself is a code auditing tool often run against source trees, the exposed process frequently has read access to sensitive application source and configuration.

Affected ProductsAI

RIPS Scanner version 0.54 (the PHP static analysis scanner formerly distributed at https://rips-scanner.sourceforge.net/) is affected, specifically the 'windows/code.php' component. No CPE string was supplied in the input, and no fixed release is identified; the project is legacy/discontinued. Vendor/advisory context is available from the VulnCheck advisory (https://www.vulncheck.com/advisories/rips-scanner-path-traversal) and the original disclosure writeup (https://codesec.blogspot.com/2015/03/rips-scanner-v-054-local-file-include.html).

RemediationAI

No vendor-released patch identified at time of analysis - RIPS Scanner 0.54 is a legacy, effectively discontinued project, so the primary recommendation is to decommission the deployment or migrate to a maintained SAST tool (e.g., the successor RIPS commercial product or another PHP static analyzer). If the instance must remain running, do not expose it to untrusted networks: restrict access to localhost or an authenticated reverse proxy/VPN and firewall the HTTP port, which prevents remote exploitation at the cost of remote convenience. As a targeted control, block or remove access to the 'windows/code.php' endpoint at the web-server/WAF layer and filter requests whose 'file' parameter contains traversal sequences ('../', encoded variants, or absolute paths) - note WAF filtering can be bypassed with alternate encodings, so it is a mitigation, not a fix. Run the PHP/web-server process under a least-privilege account with minimal filesystem read access to limit what a successful traversal can disclose. See the VulnCheck advisory (https://www.vulncheck.com/advisories/rips-scanner-path-traversal) for details.