CVE-2025-59099

The record

The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. CWE-35
• CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical… CWE-35
• CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to… CWE-35
• CVE-2026-20513 In Audio HAL, there is a possible information disclosure due to improper input validation. CWE-35
• CVE-2026-59909 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
• CVE-2026-56089 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
• CVE-2026-28157 Subscriber Path Traversal in Do Lasso <= 358 versions. CWE-35
• CVE-2026-69109 A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). CWE-35