PT-2026-4749 · Unknown · Compactwebserver

Published 2026-01-26 · Updated 2026-02-08 · CVE-2025-59099

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CompactWebServer (affected versions not specified)

Description The Access Manager utilizes CompactWebServer, a web server written in C#, which contains a path traversal flaw. This allows an attacker to access files through GET requests without authentication. Specifically, the SQLite database Database.sq3, containing badge information and PIN codes, can be retrieved. Repeated requests to certain files can cause the web server to crash, leading to a denial of service lasting approximately 60 seconds. The vulnerability allows direct file access via simple GET requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-59099

Affected Products

Compactwebserver

References · 7

• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59099 · Security Note
• https://r.sec-consult.com/dkaccess · Note
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/CVEnew/status/2015733304893563137 · Twitter Post
• https://twitter.com/transilienceai/status/2020339581564985574 · Twitter Post
• https://t.me/CVEtracker/43001 · Telegram Post