What is the CVSS score of EUVD-2025-201165?

EUVD-2025-201165 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2025-201165?

Within 24 hours: Identify all instances of Synology BeeDrive for desktop across the organization and document current versions via endpoint management tools. Within 7 days: Deploy BeeDrive version 1.4.2-13960 or later to all affected endpoints through your software update mechanism; verify installation on at least 95% of targets. Within 30 days: Complete audit of all endpoints to confirm 100% compliance with minimum version 1.4.2-13960 and document any systems unable to update for exception review.

Beedrive EUVD-2025-201165

Q: Which versions of Beedrive are affected by EUVD-2025-201165?

Synology BeeDrive for desktop versions prior to 1.4.2-13960 contain a path traversal vulnerability that enables local users to execute arbitrary code, potentially compromising data security and…. A patch is available.

| CVE-2025-54160 HIGH

Path Traversal (CWE-22)

2025-12-04 security@synology.com

RCE Path Traversal Synology Beedrive

7.8

CVSS 3.1 · Vendor: synology

View

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Sensitive files such as configuration files, credentials, or system files can be read, potentially leading to further compromise. With a CVSS score of 7.8 (HIGH), this represents a significant risk.
Exploit ScenarioDerived	An attacker modifies a file parameter to include directory traversal sequences (../../etc/passwd) to read arbitrary files from the server filesystem.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 16:35 CVSS 7.8

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

Affected VersionsENISA

BeeDrive for desktop * <1.4.2-13960

Affected Packages

euvd beedrive_for_desktop fix: 1.4.2-13960

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

Know when Beedrive gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (synology) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (synology) · only source for this CVE.

CVSS VectorVendor: synology

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:23 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.2-13960

CVE Published

Dec 04, 2025 - 16:16 nvd

HIGH 7.8

Executive ViewAI

Why It Matters

Synology BeeDrive for desktop versions prior to 1.4.2-13960 contain a path traversal vulnerability that enables local users to execute arbitrary code, potentially compromising data security and system integrity for organizations relying on this file synchronization solution. This attack requires local system access but poses significant risk to remote workers and endpoint security posture.

Business Impact: High

Compensating Controls

Apply vendor patch: Synology BeeDrive 1.4.2-13960 or later. If immediate patching is not feasible, restrict local administrative access to BeeDrive-enabled systems and monitor for suspicious process execution from BeeDrive directories pending patch deployment.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.