CVE-2025-14728: Rapid7 Velociraptor Path Traversal Flaw

CVE-2025-14728 Overview

CVE-2025-14728 is a directory traversal vulnerability [CWE-22] affecting Rapid7 Velociraptor versions before 0.75.6 running on Linux servers. A rogue client can upload a file that Velociraptor writes outside its designated datastore directory. The flaw stems from insufficient sanitization of directory names ending with a . character, where only the trailing . is percent-encoded as %2E. Exploitation is constrained because the destination directory must end with %2E, which prevents overwriting critical system files.

Critical Impact
A malicious client connecting to a Velociraptor Linux server can write files outside the datastore directory, but only into directories whose names end with %2E, limiting the practical blast radius.

Affected Products

Rapid7 Velociraptor versions prior to 0.75.6
Linux server deployments of Velociraptor
Digital forensics and incident response (DFIR) environments running vulnerable Velociraptor releases

Discovery Timeline

2025-12-29 - CVE-2025-14728 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14728

Vulnerability Analysis

Velociraptor is an open-source endpoint monitoring and DFIR platform that receives file uploads from connected clients into a server-side datastore directory. Under normal operation, the server restricts write operations to that datastore path.

On Linux servers running versions before 0.75.6, the path sanitization logic fails to correctly encode directory name components that terminate with a period. Only the final . character is transformed into its percent-encoded form %2E. Preceding path separators and traversal sequences remain intact, allowing a client-supplied path to escape the datastore root.

Because the resulting containing directory must end with %2E, an attacker cannot target arbitrary system paths such as /etc/passwd or /root/.ssh/authorized_keys. The integrity impact is scoped to attacker-controlled or attacker-created directories that carry the trailing encoded token.

Root Cause

The root cause is improper input validation in the directory name normalization routine. The sanitizer treats only the terminal . character as unsafe and encodes it, while leaving structural traversal characters and intermediate path components unfiltered. This partial encoding produces a filesystem path that the operating system resolves outside the datastore boundary.

Attack Vector

Exploitation requires a rogue or compromised Velociraptor client that connects to a vulnerable Linux server. The attacker crafts an upload request containing a directory name ending in . and uploads a file. The server writes the file to a location outside the datastore directory, provided the containing directory name terminates with %2E. No authentication is required beyond the client enrollment relationship. Attack complexity is high because the attacker must control or create a target directory matching the naming constraint.

No verified proof-of-concept code is publicly available. Refer to the Velociraptor Security Advisory CVE-2025-14728 for vendor technical details.

Detection Methods for CVE-2025-14728

Indicators of Compromise

Files written to directories on the Velociraptor server whose names end with %2E
Unexpected file creation events outside the configured datastore path owned by the Velociraptor service account
Client upload requests containing path components ending in . or the encoded sequence %2E

Detection Strategies

Audit Velociraptor server filesystem for any directory names terminating in %2E outside the datastore root
Enable filesystem auditing (auditd) on Linux servers to log write events by the Velociraptor process outside its expected working directory
Inspect Velociraptor server logs for upload operations referencing suspicious path components

Monitoring Recommendations

Baseline the Velociraptor datastore directory tree and alert on writes occurring outside that boundary
Correlate client enrollment events with subsequent unusual upload patterns to identify rogue clients
Monitor server-side process activity for the Velociraptor binary interacting with unexpected filesystem locations

How to Mitigate CVE-2025-14728

Immediate Actions Required

Upgrade Rapid7 Velociraptor to version 0.75.6 or later on all Linux servers
Review connected client inventory and revoke enrollment for any clients that cannot be attributed to a trusted asset
Inspect the server host for files or directories written outside the datastore that end in %2E

Patch Information

Rapid7 has released Velociraptor 0.75.6, which corrects the directory name sanitization logic. Administrators should follow the upgrade guidance in the Velociraptor Security Advisory CVE-2025-14728.

Workarounds

Restrict network access to the Velociraptor server frontend so that only trusted client subnets can establish connections
Run the Velociraptor server process under a dedicated low-privilege account with a mandatory access control profile (AppArmor or SELinux) constraining writes to the datastore path
Enforce strict client certificate validation and rotate enrollment credentials if any client is suspected of being compromised

bash

# Verify installed Velociraptor version and upgrade if below 0.75.6
velociraptor version

# Example AppArmor confinement snippet restricting writes to the datastore
/opt/velociraptor/velociraptor {
  /var/lib/velociraptor/** rw,
  deny /** w,
}