EUVD-2025-209203Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is able to read files on the system and/or coerce an authentication from the service, aka Directory Traversal.
AnalysisAI
Biztalk360 through version 11.5 contains a directory traversal vulnerability allowing Super User attackers to read arbitrary files on the system and coerce authentication from the service through mishandled user input in file path parameters. The vulnerability enables local file access and potential credential extraction by authenticated administrators with Super User privileges.
Technical ContextAI
The vulnerability stems from inadequate input validation and sanitization of file path parameters processed by the Biztalk360 server. The application fails to properly constrain or normalize user-supplied path inputs before performing file system operations, allowing attackers to traverse the directory structure using path traversal sequences (such as ../ or absolute path specifications). This is a classic path traversal vulnerability (related to improper input validation in file operations) where the server directly uses attacker-controlled path data without implementing proper canonicalization or access boundary checks. Biztalk360 is a monitoring and management platform for Microsoft BizTalk Server environments, making file system access particularly sensitive as it may expose configuration files, credentials, or other sensitive operational data.
RemediationAI
Upgrade Biztalk360 to a version released after 11.5 that includes fixes for directory traversal input validation. No specific patched version number is provided in available data; however, vendors typically release patched builds shortly after vulnerability disclosure. Contact Biztalk360 support or review the official security advisory at https://www.synacktiv.com/en/advisories/remote-code-execution-from-any-domain-account-in-biztalk360 for the exact recommended upgrade path. As an interim mitigation, restrict Super User account access to only those administrators who require it, enforce principle of least privilege, monitor file access patterns for suspicious traversal attempts, and implement network-level access controls to limit direct exposure of Biztalk360 administrative interfaces to trusted networks only.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today