CVE-2025-26353: Q-free Maxtime Path Traversal Vulnerability

CVE-2025-26353 Overview

CVE-2025-26353 is a path traversal vulnerability [CWE-35] in the maxtime/api/sql/sql.lua component of Q-Free MaxTime. The flaw affects all versions up to and including 2.11.0. An authenticated remote attacker can craft HTTP requests that escape the intended directory scope and read arbitrary files from the underlying host. Q-Free MaxTime is deployed in traffic management environments, where exposed configuration files, credentials, or database contents can support follow-on attacks against operational technology systems.

Critical Impact
Authenticated attackers can read sensitive files on the MaxTime host through crafted HTTP requests, exposing configuration data and credentials that support lateral movement.

Affected Products

Q-Free MaxTime versions <= 2.11.0
maxtime/api/sql/sql.lua API endpoint
Deployments exposing the MaxTime web API to authenticated users

Discovery Timeline

2025-02-12 - CVE-2025-26353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26353

Vulnerability Analysis

The vulnerability resides in the maxtime/api/sql/sql.lua handler, which processes HTTP requests that reference file paths. The handler does not properly canonicalize or validate user-supplied path input before opening files on the server. An authenticated attacker can inject relative traversal sequences such as ../ to escape the intended directory and read files outside the application scope.

Successful exploitation exposes file contents to the requesting user. The confidentiality impact is high, while integrity and availability are unaffected. Because authentication is required, exploitation depends on either legitimate account access or prior credential compromise. Files commonly targeted by path traversal include application configuration, database credentials, session tokens, and system files that reveal operator identities.

Root Cause

The root cause is insufficient input sanitization in the sql.lua file-handling logic. The application resolves user-controlled path components without enforcing an allowlist or restricting resolution to a base directory. This maps directly to CWE-35, Path Traversal using ../filename constructs.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker sends a crafted request to the vulnerable API endpoint with a path parameter containing traversal sequences. The MaxTime backend resolves the manipulated path and returns the contents of the target file to the attacker. No user interaction is required.

See the Nozomi Networks Vulnerability Advisory CVE-2025-26353 for additional technical detail.

Detection Methods for CVE-2025-26353

Indicators of Compromise

HTTP requests to maxtime/api/sql/sql.lua containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected reads of system files such as /etc/passwd, MaxTime configuration files, or database credential stores.
Authenticated API sessions issuing anomalous file-path parameters outside normal application workflows.

Detection Strategies

Inspect web server and application logs for requests to sql.lua that include path separators or encoded traversal patterns.
Correlate authenticated user sessions with file-access telemetry on the MaxTime host to identify reads outside the application directory.
Deploy web application firewall signatures that block traversal payloads targeting the MaxTime API surface.

Monitoring Recommendations

Enable verbose HTTP request logging on MaxTime and forward logs to a centralized analytics platform.
Alert on any successful HTTP 200 response to sql.lua requests containing traversal sequences.
Baseline normal API parameter values and flag deviations that reference filesystem paths.

How to Mitigate CVE-2025-26353

Immediate Actions Required

Upgrade Q-Free MaxTime to a version later than 2.11.0 as provided by the vendor.
Restrict network access to the MaxTime web interface to trusted management networks only.
Audit authenticated user accounts and rotate credentials that may have been exposed through file reads.

Patch Information

Q-Free addresses this issue in releases following 2.11.0. Consult the Nozomi Networks Vulnerability Advisory CVE-2025-26353 and Q-Free customer support channels for the fixed version and upgrade procedures.

Workarounds

Place the MaxTime API behind a reverse proxy or WAF that filters path traversal payloads before they reach sql.lua.
Enforce least privilege on the operating system account running MaxTime so traversal reads cannot access sensitive system files.
Limit authenticated user roles able to reach the maxtime/api/sql/sql endpoint to reduce the exploitable population.

bash

# Example WAF rule concept to block traversal against the MaxTime API
# ModSecurity-style pattern
SecRule REQUEST_URI "@rx maxtime/api/sql/sql\.lua" \
  "chain,id:1002653,phase:2,deny,status:403,msg:'MaxTime path traversal attempt'"
  SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" "t:lowercase"