CVE-2025-10544: DocAve Path Traversal Vulnerability

CVE-2025-10544 Overview

CVE-2025-10544 is an unrestricted file upload vulnerability [CWE-434] affecting AvePoint DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions. Administrator users can upload files without proper validation, enabling delivery of malicious payloads to the host. The flaw is compounded by a path traversal weakness that allows files to be written to arbitrary directories within the web root. An attacker with administrator privileges can combine these issues to plant executable content in a web-accessible location and compromise the underlying system.

Critical Impact
Authenticated administrators can upload arbitrary files to attacker-controlled paths inside the web root, leading to full system compromise of the affected AvePoint product.

Affected Products

AvePoint DocAve 6.13.2 and earlier
AvePoint Perimeter 1.12.3 and earlier
AvePoint Compliance Guardian 4.7.1 and earlier

Discovery Timeline

2025-09-26 - CVE-2025-10544 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10544

Vulnerability Analysis

The vulnerability stems from missing server-side validation of file uploads in the administrative interfaces of DocAve, Perimeter, and Compliance Guardian. The upload handler accepts arbitrary file types, including server-executable content such as scripts and binaries. Because the application does not enforce an allow-list of safe extensions, MIME types, or content signatures, an authenticated administrator can submit any file the underlying web stack will execute.

A second weakness in the same upload path fails to sanitize the destination filename or directory parameter. This permits directory traversal sequences such as ..\ or ../ to escape the intended upload folder. The combined result is that an attacker can both choose the payload and choose where the payload lands on disk, including locations served directly by the web root.

Root Cause

The root cause is improper input validation on two parameters of the file upload endpoint: the file content and the target path. There is no extension allow-list, no content-type verification, and no canonicalization of the supplied destination path against the configured upload directory. Authorization on the endpoint is limited to checking for administrator role, which is the only barrier that remains before file write.

Attack Vector

The attack is network-reachable and requires high privileges. An attacker who has obtained or compromised an administrator account authenticates to the AvePoint product, then submits a crafted upload request containing a server-executable payload and a destination path that uses traversal sequences to land inside the web root. Requesting the planted file through the web server triggers execution in the application's security context. Refer to the INCIBE Security Notice for vendor-coordinated technical details.

Detection Methods for CVE-2025-10544

Indicators of Compromise

New or unexpected files with executable extensions (.aspx, .ashx, .asmx, .jsp, .dll) appearing under DocAve, Perimeter, or Compliance Guardian web directories.
Upload request payloads containing path traversal sequences such as ..\ or ../ in filename or destination parameters.
Outbound network connections initiated by the AvePoint application worker process to unrecognized hosts.
Administrator account logins from atypical source addresses immediately preceding file write events.

Detection Strategies

Inspect HTTP request logs on the AvePoint management interfaces for upload endpoints carrying traversal characters or executable file extensions.
Monitor file integrity on the web root directories of DocAve, Perimeter, and Compliance Guardian installations for unauthorized new files.
Correlate administrator authentication events with subsequent file write activity by the application service account.

Monitoring Recommendations

Forward web server and application logs to a central analytics platform and alert on uploads where the filename contains .. sequences.
Track child process creation by the AvePoint application pool and flag interpreters such as cmd.exe, powershell.exe, or w3wp.exe spawning shells.
Review administrator account inventory and enforce alerting on creation, privilege change, or session activity outside business hours.

How to Mitigate CVE-2025-10544

Immediate Actions Required

Restrict network access to the AvePoint management interfaces to trusted administrative subnets only.
Rotate all administrator credentials and audit recent administrator session activity for anomalous upload requests.
Inventory files under the application web root and remove any unexpected scripts or binaries that cannot be attributed to legitimate change activity.
Apply the vendor-supplied fixes for DocAve, Perimeter, and Compliance Guardian as soon as they are available.

Patch Information

AvePoint has acknowledged the issue through the coordinated advisory published by INCIBE-CERT. Refer to the INCIBE Security Notice for the list of fixed versions and upgrade guidance for DocAve 6.13.2, Perimeter 1.12.3, and Compliance Guardian 4.7.1. Upgrade affected installations to the patched releases identified in the advisory.

Workarounds

Limit the number of accounts holding administrator role in the affected AvePoint products and enforce multi-factor authentication for those accounts.
Place the AvePoint management console behind a reverse proxy or VPN that enforces source IP allow-listing.
Configure the web server to deny execution of script handlers within upload destination directories where supported.

bash

# Example: restrict access to the AvePoint management port at the host firewall (Windows)
New-NetFirewallRule -DisplayName "Restrict AvePoint Admin" -Direction Inbound -LocalPort 14000 -Protocol TCP -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block AvePoint Admin Default" -Direction Inbound -LocalPort 14000 -Protocol TCP -Action Block