CVE-2025-65074
High · 7.2CVSS
7.2
EPSS
0.5%
Published
Dec 16, 2025
CISA due date
—
The record
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version 6.44.44
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|