CVE-2025-53880
NoneCVSS
—
EPSS
0.3%
Published
Oct 30, 2025
CISA due date
—
The record
A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Manager Proxy LTS 4.3 | release-notes-susemanager-proxy | 0 | 4.3.16.1-150400.3.101.2 |
| SUSE:Manager Server LTS 4.3 | release-notes-susemanager | 0 | 4.3.16.1-150400.3.143.2 |
Related vulnerabilities
- CVE-2025-53883 A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)… Also affects release-notes-susemanager-proxy
- CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. CWE-35
- CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical… CWE-35
- CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to… CWE-35
- CVE-2026-20513 In Audio HAL, there is a possible information disclosure due to improper input validation. CWE-35
- CVE-2026-59909 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
- CVE-2026-56089 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
- CVE-2026-28157 Subscriber Path Traversal in Do Lasso <= 358 versions. CWE-35