CVE-2025-66262 — Arbitrary File Overwrite via Tar Extraction Path Traversal

Description (CNA)

Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Tar extraction with -C / allow arbitrary file overwrite via crafted archive. The `restore_mozzi_memories.sh` script extracts user-controlled tar archives with `-C /` flag, depositing contents to the filesystem root without path validation. When combined with the unauthenticated file upload vulnerabilities (CVE-01, CVE-06, CVE-07), attackers can craft malicious .tgz archives containing path-traversed filenames (e.g., `etc/shadow`, `var/www/index.php`) to overwrite critical system files in writable directories, achieving full system compromise.

Affected (CNA)

Vendor / product	Versions
DB Electronica Telecomunicazioni S.p.A. / Mozart FM Transmitter	affected 30; affected 50; affected 100; affected 300; affected 500; affected 1000; affected 2000; affected 3000; affected 3500; affected 6000; affected 7000

CWE

CWE-22

References

https://www.abdulmhsblog.com/posts/webfmvulns/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.