CVE-2025-34206
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Vasion Print mounts host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive permissions, exposing files like secrets.env, GPG-encrypted blobs, MySQL client keys, and session files. An attacker with access to any container can read or modify these artifacts.
Risk Assessment
This can lead to credential theft, RCE via Laravel APP_KEY, Portainer takeover, and full compromise.
Recommendation
Update Vasion Print to a version containing the fix. Restrict filesystem permissions for containers and secure secret material.
Other vulnerabilities in Vasion Print
See all- CVE-2025-34222Critical
Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 expose four admin routes without authentication, allowing an unauthenticated attacker to upload, delete, or download TLS/SSL certificates and enumerate client IDs via an IDOR.
- CVE-2025-34196Critical
Vasion Print Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain a hardcoded private key for the PrinterLogic CA and a hardcoded password in configuration files such as clientsettings.dat and defaults.ini. An attacker obtaining these files can impersonate the CA and perform man-in-the-middle attacks.
Original NVD description (English source)
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in .secrets, MySQL client keys, and application session files are accessible from multiple containers. An attacker who controls or reaches any container can read or modify these artifacts, leading to credential theft, RCE via Laravel APP_KEY, Portainer takeover, and full compromise.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS