CVE-2025-13661

High · 8.0

CVSS

8.0

EPSS

1.4%

Published

Dec 9, 2025

CISA due date

—

The record

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.

Affected packages

Ecosystem	Package	Introduced	Fixed