susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal
Summary
| CVE | CVE-2025-53880 |
|---|---|
| State | PUBLISHED |
| Assigner | suse |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-30 11:15:33 UTC |
| Updated | 2026-10-18 00:10:00 UTC |
| Description | A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002890000 probability, percentile 0.213490000 (date 2026-10-27)
Problem Types: CWE-35 | CWE-35 CWE-35: Path Traversal
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | SUSE | Container Suse/manager/4.3/proxy-httpdlatest | affected ? 4.3.11-150400.3.15.3 custom | Not specified |
| CNA | SUSE | Container Suse/manager/5.0/x86 64/proxy-httpdlatest | affected ? 5.0.3-150600.3.6.4 custom | Not specified |
| CNA | SUSE | Container Suse/multi-linux-manager/5.1/x86 64/proxy-httpdlatest | affected ? 5.1.3-150700.3.3.3 custom | Not specified |
| CNA | SUSE | SUSE Manager Proxy LTS 4.3 | affected ? 4.3.11-150400.3.15.3 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.suse.com/show_bug.cgi | [email protected] | bugzilla.suse.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Paolo Perego of SUSE (en)
There are currently no legacy QID mappings associated with this CVE.