CVE-2025-26354: Q-free Maxtime Path Traversal Flaw

CVE-2025-26354 Overview

CVE-2025-26354 is a path traversal vulnerability [CWE-35] in Q-Free MaxTime version 2.11.0 and earlier. The flaw resides in the copy endpoint of maxtime/api/database/database.lua. Authenticated remote attackers can craft HTTP requests that traverse the file system and overwrite sensitive files on the host. Q-Free MaxTime is a traffic controller management platform deployed in intelligent transportation infrastructure, where file integrity directly affects safe operation. Successful exploitation impacts confidentiality, integrity, and availability of the underlying system.

Critical Impact
Authenticated attackers can overwrite arbitrary files on Q-Free MaxTime systems through the database copy endpoint, enabling full compromise of traffic controller management functionality.

Affected Products

Q-Free MaxTime versions less than or equal to 2.11.0
maxtime/api/database/database.lua component (copy endpoint)
Deployments exposing the MaxTime web API to authenticated users

Discovery Timeline

2025-02-12 - CVE-2025-26354 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2025-26354

Vulnerability Analysis

The vulnerability exists in the database copy endpoint implemented in maxtime/api/database/database.lua. The endpoint accepts a destination path parameter that the application uses to write a database file. The Lua handler does not normalize or constrain the path before passing it to file write operations. An authenticated attacker can supply traversal sequences such as ../ to escape the intended directory and target arbitrary file paths on the host.

Because the write operation runs with the privileges of the MaxTime service, an attacker can overwrite configuration files, scripts loaded at runtime, or system binaries. Overwriting an executable script that the service later invokes converts a file write primitive into code execution. The attack requires valid credentials but no user interaction.

Root Cause

The root cause is missing canonicalization and validation of user-controlled path input in the copy endpoint. The handler concatenates attacker-supplied data into a destination path without verifying that the resolved path remains within the intended database directory. This pattern matches CWE-35 (Path Traversal: .../...//).

Attack Vector

The attacker authenticates to the MaxTime web interface, then sends a crafted HTTP request to the database copy endpoint with a destination parameter containing directory traversal sequences. The server resolves the path and overwrites the targeted file with attacker-controlled content. Network reachability to the MaxTime API and valid privileged credentials are the only prerequisites.

For verified technical details, see the Nozomi Networks Vulnerability Advisory.

Detection Methods for CVE-2025-26354

Indicators of Compromise

HTTP requests to maxtime/api/database/database.lua containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f in path parameters
Unexpected modification timestamps on MaxTime configuration files, Lua scripts, or system binaries outside the database directory
New or altered files in directories not normally written to by the MaxTime service account
Authentication events from unusual source addresses preceding file write activity

Detection Strategies

Inspect web server and application logs for POST requests to the database copy endpoint with path parameters containing traversal patterns
Baseline file integrity on the MaxTime host and alert on writes to paths outside the expected database directory
Correlate authenticated API sessions with subsequent file system changes to identify abuse of legitimate accounts

Monitoring Recommendations

Enable verbose HTTP request logging on the MaxTime API and forward logs to a central SIEM for retention and search
Deploy file integrity monitoring on /etc, MaxTime install directories, and any Lua script locations
Monitor process execution following file writes by the MaxTime service to detect chained code execution

How to Mitigate CVE-2025-26354

Immediate Actions Required

Upgrade Q-Free MaxTime to a version later than 2.11.0 once a fixed release is available from the vendor
Restrict network access to the MaxTime API to trusted management hosts using firewall rules or VLAN segmentation
Rotate credentials for all MaxTime accounts and audit the user list for unused or excessive-privilege accounts
Review system logs and file integrity records for signs of prior exploitation since the affected versions were deployed

Patch Information

Refer to the Nozomi Networks Vulnerability Advisory and the Q-Free vendor channel for the patched MaxTime release. Apply the fixed version to all production and standby controllers.

Workarounds

Block external access to the maxtime/api/database/database.lua endpoint at a reverse proxy or web application firewall until patching is complete
Limit MaxTime administrative privileges to the smallest set of accounts required for operation
Run the MaxTime service under a dedicated account with minimum file system permissions to constrain the impact of arbitrary writes

bash

# Example reverse proxy rule to block the vulnerable endpoint
location ~* /maxtime/api/database/database\.lua {
    return 403;
}