CVE-2025-13879: solidserver ip address management 8.2.3; +1 more affected products

CVE-2025-13879. CVSS 3.1 base score 2.7 (LOW, NVD). EPSS 0.00538 (percentile 0.44097), scored 17-Oct-2026.

Affected technology

solidserver ip address management · 8.2.3
efficientip

SOLIDserver IPAM · 8.2.3
SOLIDserver

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An authenticated user with administrator privileges can list directories other than those to which the have authorized access using the 'directory' parameter in '/mod/ajax.php?action=sections/list/list'.For examplem setting the 'directory' parameter to '/' displays files outside the 'LOCAL:///' folder. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality impact as low; integrity and availability impact as none.

Published 18-Oct-2026 18:49 UTC

CWE: CWE-22
CCR priority: 10.9 /100 (P5)
CVSS 3.1: 2.7 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · NVD
EPSS: 0.00538 · percentile 0.44097 · 2026-10-17
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-18 18:49:36.049749+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-13879.html