CVE-2025-40549
CriticalSummary
Serv-U contains a Path Restriction Bypass vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this is scored as medium due to differences in how paths and home directories are handled.
Risk Assessment
An attacker with admin privileges could execute code in a specific directory, potentially leading to privilege escalation or further system compromise.
Recommendation
It is recommended to restrict administrative privileges, monitor administrator activities, and apply available vendor patches.
Other vulnerabilities in Serv-U
See all- CVE-2025-40548Critical
Serv-U contains a missing validation process vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
- CVE-2025-40547Critical
Serv-U contains a logic error vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
- CVE-2021-35247MediumActively exploited
The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.
- CVE-2023-35179High
A vulnerability has been identified within Serv-U 15.4 that allows bypassing multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
Original NVD description (English source)
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.