CVE-2025-12097highCWE-23

CVE-2025-12097: high-severity vulnerability in NI LabVIEW

Relative Path Traversal Vulnerability in NI System Web Server

Published · Updated

Follow this CVE+ Monitor LabVIEW

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.7%
In short

A flaw in NI System Web Server allows attackers to read files they shouldn't access by using specially crafted web requests with path traversal tricks. This puts sensitive information at risk.

Technical detail

Relative path traversal vulnerability (CWE-23) in NI System Web Server enables unauthenticated attackers to escape directory restrictions and read arbitrary files via malformed requests. Exploitation requires crafting specific path sequences; impact is information disclosure of sensitive data accessible to the web server process.

Summary generated and translated by AI from the official description.
There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.  Successful exploitation requires an attacker to send a specially crafted request to the NI System Web Server, allowing the attacker to read arbitrary files.  This vulnerability existed in the NI System Web Server 2012 and prior versions.  It was fixed in 2013.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
NI · LabVIEW
Related CVEs — NI LabVIEW

In the same product, most dangerous first.

CVE-2025-7848HIGHMissing input check in lvpict.cpp used in NI LabVIEWEPSS 6.1%CVE-2024-23612HIGHImproper Error Handling Issue in LabVIEWEPSS 0.6%CVE-2024-23611HIGHOut of Bounds Write Due to Missing Bounds Check in LabVIEWEPSS 0.6%CVE-2024-23609HIGHImproper Error Handling Issue in LabVIEWEPSS 0.6%CVE-2024-23610HIGHOut of Bounds Write Due to Missing Bounds Check in LabVIEWEPSS 0.6%CVE-2024-23608HIGHOut of Bounds Write Due to Missing Bounds Check in LabVIEWEPSS 0.6%