Home

Description

A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder, and/or affect their availability.

PUBLISHED Reserved 2025-04-16 | Published 2025-10-07 | Updated 2025-10-07 | Assigner Nozomi




HIGH: 7.2CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version before 25.2.0
affected

Default status
unaffected

Any version before 25.2.0
affected

Credits

This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation. finder

References

security.nozominetworks.com/NN-2025:9-01

cve.org (CVE-2025-40889)

nvd.nist.gov (CVE-2025-40889)

Download JSON