CVE-2025-26355 Overview
CVE-2025-26355 is a path traversal vulnerability [CWE-35] in maxtime/api/database/database.lua within Q-Free MaxTime traffic management software. Versions less than or equal to 2.11.0 are affected. An authenticated remote attacker can craft HTTP requests that escape the intended directory scope and delete sensitive files on the host. Successful exploitation degrades application integrity and availability, potentially disrupting traffic management operations that depend on MaxTime configuration and runtime data.
Critical Impact
Authenticated attackers can delete arbitrary sensitive files via crafted HTTP requests, impacting integrity and availability of Q-Free MaxTime deployments.
Affected Products
- Q-Free MaxTime versions ≤ 2.11.0
- maxtime/api/database/database.lua API endpoint
- Q-Free traffic management deployments exposing the MaxTime web API
Discovery Timeline
- 2025-02-12 - CVE-2025-26355 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26355
Vulnerability Analysis
The vulnerability resides in the database.lua handler under the maxtime/api/database/ API path. The handler processes user-supplied input that is used to construct file paths for delete operations. Because path segments such as ../ are not filtered or canonicalized, an authenticated attacker can traverse outside the intended database directory. Successful requests remove files anywhere the MaxTime service process has write permissions.
The issue requires authentication with high privileges but no user interaction. Integrity and availability impact are high because deleting configuration, log, or runtime files can disrupt MaxTime services and destroy forensic evidence.
Root Cause
The root cause is missing validation of file path parameters passed to the database.lua endpoint. The application concatenates attacker-controlled input into a filesystem path without normalizing traversal sequences or enforcing a restricted base directory allowlist, matching the CWE-35 pattern of relative path traversal via ../ sequences.
Attack Vector
Exploitation occurs over the network against the MaxTime HTTP API. An authenticated attacker sends a crafted HTTP request to the maxtime/api/database/database endpoint containing traversal sequences in a filename parameter. The Lua handler resolves the manipulated path and performs a delete operation on the target file outside the intended directory.
No public proof-of-concept exploit or CISA KEV listing exists for this vulnerability. For technical detail, see the Nozomi Networks CVE-2025-26355 Advisory.
Detection Methods for CVE-2025-26355
Indicators of Compromise
- HTTP requests to maxtime/api/database/database containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
- Unexpected deletion of MaxTime configuration files, database artifacts, or log files on the host
- Authenticated API sessions performing delete operations outside normal operator workflows
Detection Strategies
- Inspect web server and reverse proxy logs for requests to the database.lua path with suspicious query parameters or body content referencing parent directories
- Correlate authenticated MaxTime API sessions with filesystem delete events on the underlying host
- Alert on file integrity monitoring events for MaxTime installation directories outside patch windows
Monitoring Recommendations
- Enable verbose HTTP access logging on the MaxTime web tier and forward logs to a centralized analytics platform
- Deploy file integrity monitoring on MaxTime configuration, database, and log directories
- Track authentication events for privileged MaxTime accounts and flag anomalous API usage patterns
How to Mitigate CVE-2025-26355
Immediate Actions Required
- Upgrade Q-Free MaxTime to a version later than 2.11.0 that contains the vendor fix
- Restrict network access to the MaxTime API to trusted management networks only
- Rotate credentials for any privileged MaxTime accounts and review recent authenticated activity
- Review filesystem contents against known-good backups to identify files deleted by traversal requests
Patch Information
Q-Free MaxTime versions ≤ 2.11.0 are affected. Consult the Nozomi Networks CVE-2025-26355 Advisory and contact Q-Free for the fixed release and upgrade procedure applicable to your deployment.
Workarounds
- Place the MaxTime web interface behind a reverse proxy or web application firewall that blocks path traversal patterns in requests to maxtime/api/database/*
- Enforce network segmentation so only authorized operator workstations can reach the MaxTime API
- Apply least-privilege filesystem permissions to the MaxTime service account to limit the scope of any deletion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
