Vulnerability · Published Mar 13, 2025 · Assigned by tenable
CVE-2025-2264Santesoft Sante PACS Server Path Traversal Information Disclosure
High 7.5
In plain English
A high-severity path traversal in Sante PACS Server from Santesoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 35.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)35.4%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Metasploit, Nuclei
Official description
A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Santesoft | Sante PACS Server | 4.1.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N