CVE-2025-40549
CriticalSummary
Serv-U contains a Path Restriction Bypass vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this is scored as medium due to differences in how paths and home directories are handled.
Risk Assessment
An attacker with admin privileges could execute code in a specific directory, potentially leading to privilege escalation or further system compromise.
Recommendation
It is recommended to restrict administrative privileges, monitor administrator activities, and apply available vendor patches.
Original NVD description (English source)
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.