What is the CVSS score of EUVD-2025-209777?

EUVD-2025-209777 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of docuFORM MPS Client are affected by EUVD-2025-209777?

docuFORM Managed Print Service Client 11.11c contains a path traversal vulnerability allowing unauthenticated attackers to read any file accessible by the service account, risking exposure of…

How to fix or mitigate EUVD-2025-209777?

Within 24 hours, inventory all systems running docuFORM 11.11c and identify which access sensitive data or operate with privileged service accounts. Within 7 days, implement network segmentation to restrict access to the MPS client to authorized networks only, apply principle of least privilege to the service account's file permissions, and enable request logging to detect exploitation attempts. Within 30 days, monitor vendor advisories for patch availability and establish a testing plan for deployment; activate compensating controls immediately and reassess risk tolerance if no patch becomes available within 60 days.

docuFORM MPS Client EUVD-2025-209777

| CVE-2025-65418 HIGH

Path Traversal (CWE-22)

2026-05-11 mitre

GHSA-x8x5-wj5f-wpqr

Path Traversal N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated crafted URL with no user interaction yields arbitrary file read, so AV:N/AC:L/PR:N/UI:N and C:H; read-only impact means I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:05 vuln.today

CVSS changed

May 12, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.5

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted url.

AnalysisAI

Arbitrary file read in docuFORM Managed Print Service Client 11.11c lets remote unauthenticated attackers retrieve any file the service account can access by supplying a crafted URL that escapes the intended directory. The flaw is a classic path traversal (CWE-22) scored CVSS 7.5 for full confidentiality loss with no impact to integrity or availability. A public gist attributed to ZeroBreach GmbH suggests publicly available exploit code exists, though EPSS remains very low (0.05%) and it is not listed in CISA KEV, so no public confirmation of active exploitation exists.

Technical ContextAI

docuFORM's Managed Print Service (MPS) is a print-management/monitoring platform from the German vendor docuFORM GmbH; the affected component is its MPS Client, which exposes an HTTP-reachable interface. The vulnerability is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning user-supplied path input in a URL is used to build a filesystem path without adequate canonicalization or sanitization, so traversal sequences (e.g. ../../) let the request resolve outside the intended web/document root. The CPE provided by the source is a placeholder ('cpe:2.3:a:n/a:n/a'), so the exact affected product/vendor CPE is not authoritatively recorded in the intelligence feed and must be taken from the description text (docuFORM MPS Client 11.11c).

RemediationAI

No vendor-released patch version is identified in the available data, so contact docuFORM (https://www.docuform.de/) for a fixed release of the MPS Client and upgrade past 11.11c once one is published; do not treat absence of a listed patch as confirmation none exists. As compensating controls until a patch is applied: restrict network access to the MPS Client HTTP interface using firewall/ACL rules so only trusted management hosts can reach it, place it behind a reverse proxy or WAF that normalizes and rejects path-traversal sequences (../, encoded %2e%2e, absolute paths) in the URL, and run the service under a least-privilege account so an arbitrary-read only exposes the minimum set of files. The trade-off of the proxy/WAF approach is that filter bypasses (double-encoding, alternate separators) are common, so it is mitigation not remediation; network restriction is the most reliable interim control but may break legitimate remote management access. Reference the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2025-65418) for updates.