Vulnerability · Published May 16, 2025 · Assigned by INCIBE

CVE-2025-40629Path Traversal vulnerability in PNETLab

High 8.7

In plain English

A high-severity path traversal in PNETLab from PNETLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory.

Affected products (as reported)

Vendor	Product	Versions
PNETLab	PNETLab	4.2.10

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-pnetlab