CVE-2025-26352: Q-free Maxtime Path Traversal Vulnerability

CVE-2025-26352 Overview

CVE-2025-26352 is a path traversal vulnerability [CWE-35] in the template deletion mechanism of Q-Free MaxTime, a traffic management system. The flaw affects all versions up to and including 2.11.0. An authenticated remote attacker can send crafted HTTP requests to delete arbitrary files on the host system. Successful exploitation compromises file integrity and system availability but does not expose file contents.

Critical Impact

Authenticated attackers can delete sensitive files on affected MaxTime deployments, potentially disrupting traffic management operations and corrupting application state.

Affected Products

• Q-Free MaxTime versions <= 2.11.0

Discovery Timeline

• 2025-02-12 - CVE-2025-26352 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26352

Vulnerability Analysis

Q-Free MaxTime exposes a template management interface that allows authenticated users to delete template files. The deletion endpoint fails to validate or sanitize user-supplied path components before passing them to file system operations. An attacker can embed directory traversal sequences such as ../ in the request parameters to escape the intended template directory. This grants the attacker the ability to remove arbitrary files reachable by the application process. Because MaxTime orchestrates traffic signal operations, deleting configuration files, binaries, or logs can disrupt operational continuity and hinder forensic review.

Root Cause

The root cause is improper neutralization of path traversal elements, classified under [CWE-35: Path Traversal: '.../...//']. The template deletion handler trusts the file identifier supplied in the HTTP request and concatenates it to a base path without canonicalization or allow-list validation. Any file the MaxTime service account has delete permissions on becomes reachable.

Attack Vector

Exploitation requires network access to the MaxTime web interface and valid high-privilege credentials. The attacker crafts an HTTP request to the template deletion endpoint, substituting the template name with a traversal payload that resolves to a sensitive file path. No user interaction is required. Full technical analysis is available in the Nozomi Networks Vulnerability Advisory.

Detection Methods for CVE-2025-26352

Indicators of Compromise

• HTTP requests to MaxTime template management endpoints containing ../, ..\, or URL-encoded variants such as %2e%2e%2f.
• Unexpected deletion of files outside the designated template directory, visible in file system audit logs.
• Application error messages or stack traces referencing missing configuration, binary, or log files following authenticated sessions.

Detection Strategies

• Inspect web server access logs for traversal sequences in request parameters targeting template-related URIs.
• Correlate authenticated MaxTime session activity with file deletion events on the host operating system.
• Baseline normal template management traffic and alert on anomalous DELETE operations or atypical request parameters.

Monitoring Recommendations

• Enable file integrity monitoring on MaxTime installation directories and adjacent system paths.
• Forward MaxTime application and web server logs to a centralized SIEM for retention and correlation.
• Monitor privileged account usage within MaxTime and alert on template deletion activity outside maintenance windows.

How to Mitigate CVE-2025-26352

Immediate Actions Required

• Upgrade Q-Free MaxTime to a version later than 2.11.0 once the vendor patch is available.
• Restrict network access to the MaxTime management interface using firewall rules or VPN segmentation.
• Rotate credentials for all MaxTime accounts and enforce least-privilege role assignments.
• Review file system audit logs for evidence of unauthorized deletion activity.

Patch Information

Refer to the Nozomi Networks Vulnerability Advisory and contact Q-Free directly for patched release availability. No vendor advisory URL is listed in the NVD record at the time of publication.

Workarounds

• Limit MaxTime administrative access to a small set of trusted operators pending patch deployment.
• Place the MaxTime web interface behind a reverse proxy that normalizes URLs and strips traversal sequences.
• Run the MaxTime service under an account with minimal file system permissions to reduce the blast radius of arbitrary file deletion.

# Example reverse proxy rule to block traversal sequences
# nginx configuration snippet
location /maxtime/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://maxtime_backend;
}