PT-2025-33096 · Unknown · Unform Server Manager

Jan Rodriguez · Published 2025-08-13 · Updated 2025-08-14 · CVE-2025-34154

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: UnForm Server Manager versions prior to 10.1.12

Description: UnForm Server Manager versions prior to 10.1.12 contain an unauthenticated file read flaw in the log file analysis interface. The vulnerability is located in the arc endpoint, which accepts a fl parameter specifying the log file to open. Insufficient input validation and path sanitization allow attackers to use relative paths to access arbitrary files on the host system without authentication, potentially including sensitive OS-level files.

Recommendations: Update UnForm Server Manager to version 10.1.12 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-34154

Affected Products

Unform Server Manager

References · 10

• 🔥 https://gist.github.com/Janrdrz/3cf67a9ad488e07ceaacd7c1a7e59ae7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34154 · Security Note
• https://twitter.com/CVEnew/status/1955900302567367144 · Twitter Post
• https://t.me/CVEtracker/29943 · Telegram Post
• https://unform.com/download/uf101_readme.txt · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1955867057238540672 · Twitter Post
• https://twitter.com/CveFindCom/status/1955738653403050307 · Twitter Post
• https://twitter.com/Thendcrack/status/1956013014521426138 · Twitter Post
• https://vulncheck.com/advisories/unform-server-manager-unauthenticated-arbitrary-file-read · Note
• https://synergetic-data.com · Note