CVE-2025-13161: IQ-Support Path Traversal Vulnerability

CVE-2025-13161 Overview

CVE-2025-13161 is an arbitrary file read vulnerability in IQ-Support, a product developed by IQ Service International. The flaw stems from improper handling of user-supplied file paths, classified as Relative Path Traversal [CWE-23]. Unauthenticated remote attackers can exploit the issue over the network to download arbitrary files from the underlying system. The vulnerability was disclosed through TW-CERT, the Taiwan Computer Emergency Response Team.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the host operating system, including configuration files, credentials, and application source code.

Affected Products

IQ-Support (developed by IQ Service International)
Specific affected versions are not enumerated in the published NVD record
Refer to the TW-CERT advisory for version-specific guidance

Discovery Timeline

2025-11-14 - CVE CVE-2025-13161 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13161

Vulnerability Analysis

The vulnerability is a Relative Path Traversal weakness in IQ-Support's file handling logic. The application accepts a file path or filename parameter from a remote HTTP request and uses it to construct a path to a resource on disk. Because the application fails to canonicalize the input or restrict it to an allowed directory, attackers can supply traversal sequences such as ../ to escape the intended directory.

The issue requires no authentication and no user interaction. An attacker who can reach the IQ-Support web interface over the network can issue a single crafted request to retrieve arbitrary readable files. Recoverable data typically includes application configuration, database connection strings, session tokens, private keys, and operating system files such as /etc/passwd or C:\Windows\win.ini.

Root Cause

The root cause is insufficient input validation on a file-path parameter. The application concatenates attacker-controlled input with a base directory and passes the result to a file-read routine without rejecting parent-directory references or non-canonical paths. This matches the [CWE-23] pattern of relative path traversal.

Attack Vector

Exploitation occurs over the network against the IQ-Support service. The attacker sends an HTTP request containing a manipulated path parameter that traverses outside the intended document root. The server responds with the file contents, enabling pre-authentication information disclosure that can be chained into credential theft and follow-on intrusion.

No public proof-of-concept exploit code has been released. See the TW-CERT Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2025-13161

Indicators of Compromise

HTTP requests to IQ-Support endpoints containing path traversal sequences such as ../, ..\, %2e%2e%2f, or %252e%252e%252f
Outbound responses from the IQ-Support host containing contents of sensitive system files (for example /etc/passwd, /etc/shadow, web.config, or .env)
Unusual access patterns from a single source IP enumerating sequential file paths against IQ-Support

Detection Strategies

Inspect web server and application logs for query strings or POST bodies containing encoded or unencoded traversal tokens targeting IQ-Support routes
Deploy Web Application Firewall (WAF) signatures for relative path traversal and alert on matches at the IQ-Support virtual host
Correlate file-read response sizes and content types against baseline behavior to flag retrieval of unexpected file types

Monitoring Recommendations

Forward IQ-Support web access logs, application logs, and host file-access telemetry to a centralized SIEM for retention and analysis
Alert on any anonymous (unauthenticated) HTTP request that successfully returns server-side file content
Monitor for subsequent authentication anomalies that may indicate credentials extracted from configuration files are being reused

How to Mitigate CVE-2025-13161

Immediate Actions Required

Restrict network exposure of the IQ-Support interface to trusted management networks or place it behind a VPN until a patch is applied
Apply WAF rules that block path traversal payloads in all parameters served by IQ-Support
Rotate any credentials, API keys, or certificates stored in files reachable from the IQ-Support host, since they may already be exposed

Patch Information

IQ Service International coordinated disclosure through TW-CERT. Administrators should obtain the fixed release directly from the vendor and consult the TW-CERT Security Advisory and the TW-CERT Incident Report for version guidance. No fixed-version identifier is published in the NVD record at this time.

Workarounds

Place IQ-Support behind a reverse proxy that strips or rejects traversal sequences before forwarding requests
Run the IQ-Support service under a least-privilege account that cannot read sensitive operating system or application files
Apply filesystem-level access controls so the service account is confined to its required working directories

bash

# Example NGINX reverse proxy rule blocking path traversal attempts
location /iq-support/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    proxy_pass http://iq-support-backend;
}