CVE-2025-54769 — KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal

CVE-2025-54769

KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal PUBLISHED

Description (CNA)

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

Affected (CNA)

Vendor / product	Versions
Xorux / LPAR2RRD	affected 8.04

CWE

CWE-24, CWE-434, CWE-648

References

https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt
https://lpar2rrd.com/note800.php

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/19