PT-2025-52222 · Unknown · Import Arc

Andrea Palanca · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-40898

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Import Arc (affected versions not specified)

Description A path traversal issue exists in the Import Arc data archive functionality because of inadequate input file validation. An authenticated user with limited privileges can potentially write arbitrary files to arbitrary paths by uploading a specially crafted Arc data archive. This could lead to alterations in the device configuration and/or affect its availability. The vulnerability allows writing arbitrary files in arbitrary paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-40898

Affected Products

Import Arc

References · 8

• https://osv.dev/vulnerability/CVE-2025-40898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40898 · Security Note
• https://security.nozominetworks.com/NN-2025:15-01 · Vendor Advisory
• https://t.me/CVEtracker/40151 · Telegram Post
• https://twitter.com/CVEnew/status/2001728070022238555 · Twitter Post
• https://twitter.com/TheHackerWire/status/2001658607235141717 · Twitter Post
• https://t.me/cveNotify/146195 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-827968.html · Note