← back
CVE-2025-54769

KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal

CVSS 8.8 HIGHEPSS 2.9%CWE-24CWE-434CWE-648
An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Xorux · LPAR2RRD
public PoCs found — 2
githubgithub.com/byteReaper77/CVE-2025-54769★ 2exploitdbwww.exploit-db.com/exploits/52391unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://seclists.org/fulldisclosure/2025/Jul/19https://korelogic.com/Resources/Advisories/KL-001-2025-016.txthttps://lpar2rrd.com/note800.php