CVE-2025-26356: Q-free Maxtime Path Traversal Flaw

CVE-2025-26356 Overview

CVE-2025-26356 is a path traversal vulnerability [CWE-35] in Q-Free MaxTime versions 2.11.0 and earlier. The flaw resides in the setActive endpoint of maxtime/api/database/database.lua. An authenticated remote attacker can submit crafted HTTP requests to overwrite sensitive files on the underlying system. Successful exploitation breaks the confidentiality, integrity, and availability of the affected traffic controller software.

Critical Impact
An authenticated attacker can overwrite arbitrary files on MaxTime systems, enabling tampering with traffic management software and supporting components.

Affected Products

Q-Free MaxTime versions <= 2.11.0
maxtime/api/database/database.lua module (setActive endpoint)
Deployments exposing the MaxTime management API to authenticated users

Discovery Timeline

2025-02-12 - CVE-2025-26356 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26356

Vulnerability Analysis

The vulnerability exists in the setActive endpoint handled by maxtime/api/database/database.lua. The endpoint accepts a user-supplied file or path parameter that it then writes to without validating directory boundaries. Because the application fails to canonicalize input or reject traversal sequences such as ../, an authenticated user can direct write operations outside the intended database directory.

The attack requires valid authentication and network access to the MaxTime API. Once exploited, an attacker can overwrite system configuration files, application binaries, or scripts that influence runtime behavior. This can pivot a low-trust authenticated foothold into administrative compromise of the host running MaxTime.

MaxTime is deployed in traffic management environments, so file overwrite primitives carry operational technology risk beyond standard IT impact. Tampered files may persist across service restarts and propagate through backup processes.

Root Cause

The root cause is missing path canonicalization and allowlist validation in the setActive handler. The Lua endpoint trusts client-controlled path components and concatenates them into a filesystem write operation. There is no enforcement that the resolved path remains within the intended database directory.

Attack Vector

Exploitation occurs over the network against the MaxTime HTTP API. The attacker must hold valid credentials, which raises the privilege requirement but does not eliminate insider or credential-theft scenarios. The attacker sends a crafted HTTP request to the setActive endpoint with a path parameter containing traversal sequences pointing at a sensitive target file. The server writes attacker-controlled content to that location.

No verified public exploit code is available. For technical details, see the Nozomi Networks Vulnerability Advisory.

Detection Methods for CVE-2025-26356

Indicators of Compromise

HTTP requests to maxtime/api/database/database.lua containing ../ or encoded traversal sequences such as %2e%2e%2f in the setActive parameters
Unexpected modifications to files outside the MaxTime database directory, especially configuration files, init scripts, or web roots
New or altered files owned by the MaxTime service account in system directories
Authentication logs showing API access from atypical source addresses prior to file changes

Detection Strategies

Inspect MaxTime web server logs for requests targeting the setActive endpoint with path traversal patterns or absolute paths
Deploy file integrity monitoring on the MaxTime installation directory and adjacent system paths
Correlate authenticated API sessions with subsequent filesystem write events on the host
Alert on writes performed by the MaxTime process outside its expected working directory

Monitoring Recommendations

Forward MaxTime application and web server logs to a centralized logging platform for retention and search
Baseline normal setActive usage patterns and alert on parameter anomalies
Monitor process and file telemetry from the MaxTime host for unexpected child processes or script executions following API calls

How to Mitigate CVE-2025-26356

Immediate Actions Required

Restrict network access to the MaxTime management API using firewall rules or VPN-only access
Rotate credentials for all MaxTime user accounts and enforce least privilege on API roles
Audit the MaxTime installation for modified files, particularly within configuration and script directories
Review the Nozomi Networks Vulnerability Advisory for vendor remediation guidance

Patch Information

Q-Free MaxTime versions <= 2.11.0 are affected. Operators should contact Q-Free for a fixed release and apply it across all deployments. No vendor advisory URL is listed in the NVD record at the time of writing.

Workarounds

Disable or block access to the setActive endpoint at a reverse proxy if patching is not immediately possible
Limit MaxTime API access to a small set of trusted administrative source addresses
Run the MaxTime service under a dedicated low-privilege account with filesystem permissions scoped to its working directory
Enable filesystem-level access controls, such as mandatory access control policies, to constrain writes outside the database directory

bash

# Example reverse proxy rule to block traversal patterns on the setActive endpoint
location ~* /maxtime/api/database/database\.lua {
    if ($args ~* "(\.\./|%2e%2e%2f|%2e%2e/)") { return 403; }
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://maxtime_backend;
}