Vulnerability · Published Jul 28, 2025 · Assigned by KoreLogic
CVE-2025-54769KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
High 8.8
In plain English
A high-severity unrestricted file upload in LPAR2RRD from Xorux. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)3.6%top 10.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.
Affected products (as reported)
Weakness: CWE-24, CWE-434, CWE-648 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt third-party-advisory
- https://lpar2rrd.com/note800.php release-notes
- http://seclists.org/fulldisclosure/2025/Jul/19