PT-2025-48667 · Solidsoft · Solidserver Ipam

Ramón Costales · Published 2025-12-02 · Updated 2026-01-30 · CVE-2025-13879

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SOLIDserver IPAM version 8.2.3

Description A directory traversal issue exists in SOLIDserver IPAM version 8.2.3. An authenticated user with administrator privileges can list directories beyond their authorized access. This is possible by manipulating the directory parameter within the ''/mod/ajax.php?action=sections/list/list'' API endpoint. Specifically, setting the directory parameter to '/' reveals files outside the 'LOCAL:///' folder.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ''/mod/ajax.php?action=sections/list/list'' API endpoint. Sanitize the directory parameter to prevent directory traversal attempts.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13879

Affected Products

Solidserver Ipam

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13879 · Security Note
• https://efficientip.com/resources/solidserver-ipam-solutions-3 · Patch
• https://osv.dev/vulnerability/CVE-2025-13879 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/directory-traversal-vulnerability-efficientips-solidserver-ipam · Note
• https://t.me/CVEtracker/38670 · Telegram Post
• https://twitter.com/CVEnew/status/1995848698853757231 · Twitter Post
• https://t.me/cveNotify/150444 · Telegram Post