CVE-2025-26354: high-severity vulnerability in Q-Free MaxTime
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An authenticated user can bypass file access restrictions in Q-Free MaxTime and overwrite important files by using specially crafted requests to the copy endpoint. This allows attackers with login access to damage or manipulate system files.
Path traversal vulnerability in the copy endpoint of maxtime/api/database/database.lua permits authenticated attackers to escape directory restrictions and overwrite arbitrary files. The vulnerability requires valid authentication credentials and allows file system manipulation through crafted HTTP requests, impacting confidentiality and integrity of protected resources.
In the same product, most dangerous first.