CVE-2025-26350 Overview
CVE-2025-26350 is an unrestricted file upload vulnerability [CWE-434] in Q-Free MaxTime versions 2.11.0 and earlier. The flaw resides in the template file upload functionality of the traffic management platform. An authenticated remote attacker can upload files of dangerous types through crafted HTTP requests. Successful exploitation can lead to arbitrary code execution on the underlying host. Q-Free MaxTime is deployed in transportation and intelligent traffic system environments, making the impact relevant to operational technology operators.
Critical Impact
An authenticated attacker can upload malicious files to the MaxTime server and execute arbitrary code, compromising confidentiality, integrity, and availability of the traffic management host.
Affected Products
- Q-Free MaxTime versions <= 2.11.0
- Q-Free MaxTime template upload component
- Deployments exposing the MaxTime web interface to authenticated users
Discovery Timeline
- 2025-02-12 - CVE-2025-26350 published to NVD
- 2025-10-24 - Last updated in NVD database
Technical Details for CVE-2025-26350
Vulnerability Analysis
The vulnerability stems from missing file type and content validation in the template upload endpoint of Q-Free MaxTime. The application accepts files supplied to the template upload feature without enforcing safe extensions, MIME types, or content inspection. An authenticated user can submit a crafted HTTP request containing a payload disguised as a template. The server stores the file in a location reachable by the web service, allowing the attacker to invoke it. This pattern matches [CWE-434] Unrestricted Upload of File with Dangerous Type.
Root Cause
The template upload handler trusts client-supplied metadata and does not restrict allowed file extensions. Server-side validation of file content, size, and storage path is insufficient. Files placed through the upload routine remain executable by the application server, which converts a benign upload feature into a code delivery channel.
Attack Vector
Exploitation requires network access to the MaxTime web interface and valid authenticated credentials. The attacker issues a crafted multipart HTTP request to the template upload endpoint with a payload such as a server-side script. After upload, the attacker requests the stored file to trigger execution under the privileges of the MaxTime service account. No user interaction is required beyond the initial authenticated session. Refer to the Nozomi Networks Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2025-26350
Indicators of Compromise
- Unexpected files with executable extensions written to MaxTime template storage directories.
- HTTP POST requests to template upload endpoints originating from non-administrative user accounts.
- New child processes spawned by the MaxTime web service following template upload activity.
Detection Strategies
- Monitor web server access logs for POST requests to the template upload path followed by GET requests retrieving the uploaded artifact.
- Alert on file creation events in MaxTime web-accessible directories where extensions deviate from the expected template format.
- Correlate authentication events with upload activity to identify low-privilege accounts performing template modifications.
Monitoring Recommendations
- Enable verbose logging on the MaxTime application server, including request bodies and uploaded file metadata.
- Forward MaxTime host telemetry, including process execution and file write events, to a centralized SIEM for retention and correlation.
- Baseline normal template upload behavior so that anomalous file types, sizes, or upload frequencies generate alerts.
How to Mitigate CVE-2025-26350
Immediate Actions Required
- Restrict network access to the MaxTime web interface to trusted administrative networks only.
- Audit MaxTime user accounts and revoke credentials that do not require template management privileges.
- Inspect template storage directories for unexpected files and remove any unauthorized artifacts.
Patch Information
Q-Free MaxTime versions <= 2.11.0 are affected. Operators should consult Q-Free directly and review the Nozomi Networks Vulnerability Advisory for current fix availability and upgrade guidance.
Workarounds
- Place the MaxTime web interface behind a VPN or network segmentation boundary to reduce exposure.
- Enforce strong authentication and multi-factor authentication for all MaxTime accounts to limit unauthorized authenticated access.
- Apply web application firewall rules that block uploads containing executable extensions or script content to the template endpoint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
