PT-2025-42163 · Fastx3 · Fastx3

Published 2025-10-14 · Updated 2025-10-16 · CVE-2025-57618

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FastX3 versions through 3.3.67

Description A path traversal issue exists in FastX3 through version 3.3.67, allowing an unauthenticated attacker to read arbitrary files on the server. This access can include application configuration files containing the secret key used to sign JSON Web Tokens (JWTs) and existing JWT IDs (JTIs). Exploitation enables an attacker to forge valid JWTs, impersonate the root user, and potentially achieve remote code execution through authenticated API endpoints. The vulnerability allows access to sensitive information like the secret key used for JWT signing and existing JTIs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2025-57618

Affected Products

Fastx3

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-57618 · Security Note
• https://starnet.com/help/fastx3-3-server-release-notes · Note
• https://starnet.com/fastx · Note
• https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md?ref_type=heads · Note
• https://twitter.com/VulmonFeeds/status/1978284473180438561 · Twitter Post
• https://twitter.com/CVEnew/status/1978932616037638542 · Twitter Post