CVE-2025-15314: Tanium End-user-cx Path Traversal Flaw

CVE-2025-15314 Overview

CVE-2025-15314 is an arbitrary file deletion vulnerability in Tanium end-user-cx. The flaw allows an authenticated attacker with low privileges to delete arbitrary files over the network without user interaction. Tanium has addressed the issue and published security advisory TAN-2025-010. The weakness is categorized under [CWE-59] (Improper Link Resolution Before File Access, also known as link following), indicating that symbolic link or junction handling enables the attacker to delete files outside intended directories. Successful exploitation can corrupt application data, remove system files, and cause denial-of-service conditions on affected hosts.

Critical Impact
An authenticated remote attacker can delete arbitrary files on systems running vulnerable versions of Tanium end-user-cx, leading to integrity loss and service disruption.

Affected Products

Tanium end-user-cx (see vendor advisory TAN-2025-010 for affected version ranges)
Deployments where end-user-cx services accept low-privileged authenticated requests
Endpoints running the vulnerable end-user-cx component as part of the Tanium platform

Discovery Timeline

2026-02-10 - CVE CVE-2025-15314 published to NVD
2026-02-20 - Last updated in NVD database

Technical Details for CVE-2025-15314

Vulnerability Analysis

The vulnerability resides in the file handling logic of Tanium end-user-cx. An authenticated attacker can trigger a file deletion operation that resolves paths through symbolic links or similar filesystem links. Because the component does not safely resolve link targets before performing deletion, the operation can be redirected to files outside the intended working directory.

The CWE-59 classification points to a link-following weakness. Attackers exploit this by planting or referencing a link that points to a sensitive file. When the application executes its deletion routine, the kernel follows the link and removes the attacker-chosen target instead of the intended file.

The impact profile shows high integrity and availability impact with no confidentiality impact. This is consistent with a deletion primitive: attackers cannot read file contents but can destroy or remove them, disrupting application state and host operations.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. The application performs deletion operations on file paths without validating that the resolved target lies within an expected directory or without using link-safe APIs that refuse to follow symbolic links during privileged file operations.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker authenticated to the Tanium platform with low-privileged access can submit requests that cause the vulnerable component to delete attacker-specified files. The vulnerability mechanism is described in prose only as no verified public proof-of-concept code is available. Refer to the Tanium Security Advisory TAN-2025-010 for vendor-supplied technical details.

Detection Methods for CVE-2025-15314

Indicators of Compromise

Unexpected deletion of files within or adjacent to the Tanium end-user-cx installation directory
Presence of newly created symbolic links, junctions, or hard links inside directories writable by the end-user-cx service
Application or service errors caused by missing configuration files, logs, or binaries on managed endpoints
Authenticated API or session activity from low-privileged accounts immediately preceding file deletion events

Detection Strategies

Enable filesystem auditing on endpoints running end-user-cx and alert on delete operations performed by the service account against paths outside its expected working directories
Monitor for creation of symbolic links or NTFS junctions by non-administrative users in directories accessed by Tanium components
Correlate Tanium authentication events for low-privileged accounts with subsequent file deletion telemetry to identify abuse patterns

Monitoring Recommendations

Forward endpoint filesystem and process telemetry to a centralized analytics platform and retain at least 30 days of history for incident review
Baseline normal file activity for the end-user-cx process and alert on deviations such as bursts of deletions or access to system paths
Track changes to the Tanium advisory page at Tanium Security Advisory TAN-2025-010 for updated indicators and fixed versions

How to Mitigate CVE-2025-15314

Immediate Actions Required

Identify all hosts running Tanium end-user-cx and inventory installed versions against the fixed versions listed in TAN-2025-010
Apply the vendor-supplied update from Tanium as soon as it is validated in a test environment
Restrict low-privileged Tanium user accounts and review role assignments to enforce least privilege
Audit recent filesystem activity on affected hosts to identify any pre-existing exploitation attempts

Patch Information

Tanium has addressed the arbitrary file deletion vulnerability in end-user-cx. Refer to the Tanium Security Advisory TAN-2025-010 for the list of fixed versions, upgrade guidance, and any prerequisite steps. Customers should follow the vendor's standard patch deployment procedure across all impacted endpoints.

Workarounds

Limit network access to end-user-cx endpoints to trusted management networks until patching is complete
Reduce the number of accounts holding the low-privilege roles required to reach the vulnerable code path
Enforce filesystem permissions that prevent non-privileged users from creating symbolic links in directories used by the Tanium service

bash

# Configuration example
# Refer to TAN-2025-010 for vendor-specified mitigation and upgrade commands.
# General hardening: disable unprivileged symlink creation on Linux endpoints
sysctl -w fs.protected_symlinks=1
sysctl -w fs.protected_hardlinks=1