Vulnerability · Published Jul 16, 2025 · Assigned by VulnCheck
CVE-2025-34118Linknat VOS Manager Path Traversal File Disclosure
High 8.7
In plain English
A high-severity path traversal in VOS Manager from Linknat Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/', '/chs/', or '/cht/', where the 'js/lang_en_us.js' or equivalent files are loaded. By injecting encoded traversal sequences such as '%c0%ae%c0%ae' into the request path, attackers can bypass input validation and disclose sensitive files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linknat Technology | VOS Manager | 0 – through VOS20090 – through VOS3000 2.1.9.06 |
Weakness: CWE-22, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- http://www.linknat.com/ product
- https://web.archive.org/web/20151013001957/http://www.wooyun.org/bugs/wooyun-2010-0145458 third-party-advisory
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linknat_vos_traversal.rb exploit
- https://www.vulncheck.com/advisories/linknat-vos-manager-path-traversal-file-disclosure third-party-advisory