PT-2025-7140 · Q Free · Q-Free Maxtime

Diego Giubertoni + 1 · Published 2025-02-12 · Updated 2025-10-24 · CVE-2025-26351

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0

Description: A Path Traversal issue in the template download mechanism allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. This issue enables the attacker to access confidential files through manipulated HTTP requests.

Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the template download mechanism to minimize the risk of exploitation. Avoid using the vulnerable template download feature until the issue is resolved.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-26351

Affected Products

Q-Free Maxtime

References · 5

• https://osv.dev/vulnerability/CVE-2025-26351 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26351 · Security Note
• https://t.me/cveNotify/140212 · Telegram Post
• https://twitter.com/CVEnew/status/1889673453650784261 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-26351 · Note