CVE-2025-26357: Q-free Maxtime Path Traversal Vulnerability

CVE-2025-26357 Overview

CVE-2025-26357 is a path traversal vulnerability [CWE-35] in the maxtime/api/database/database.lua endpoint of Q-Free MaxTime. The flaw affects all versions up to and including 2.11.0. An authenticated remote attacker can send crafted HTTP requests to read arbitrary files from the host operating system. Q-Free MaxTime is a traffic signal controller management application used in intelligent transportation system (ITS) deployments. Successful exploitation exposes sensitive configuration data, credentials, and system files that reside outside the intended web directory.

Critical Impact

Authenticated attackers can traverse directories through database.lua to disclose sensitive files, exposing credentials and configuration that enable lateral movement across traffic management infrastructure.

Affected Products

• Q-Free MaxTime versions ≤ 2.11.0
• maxtime/api/database/database.lua API endpoint
• Deployments exposing the MaxTime web interface to authenticated users

Discovery Timeline

• 2025-02-12 - CVE-2025-26357 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26357

Vulnerability Analysis

The vulnerability resides in the database.lua handler under the maxtime/api/database/ API path. The handler accepts a user-supplied parameter that is incorporated into a filesystem path without proper canonicalization or allow-list validation. An attacker who holds valid credentials can submit relative traversal sequences such as ../ to escape the intended database directory. The resulting file read returns arbitrary host content to the attacker over HTTP. Because MaxTime runs on traffic control infrastructure, disclosed files may include operator credentials, device configuration, and keys used to communicate with field controllers.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-35]. The affected Lua endpoint concatenates attacker-controlled input into a file path and dereferences the result without resolving symbolic traversal tokens or enforcing a base directory check. No normalization step rejects .. sequences or absolute paths before the file read occurs.

Attack Vector

Exploitation requires network reachability to the MaxTime web interface and valid authentication credentials. The attacker issues an HTTP request to the vulnerable database.lua endpoint with a crafted path parameter containing directory traversal characters. The server resolves the path, opens the referenced file, and returns its contents in the HTTP response. No user interaction is required beyond the attacker's own authenticated session. Refer to the Nozomi Networks Vulnerability Advisory CVE-2025-26357 for additional technical details.

Detection Methods for CVE-2025-26357

Indicators of Compromise

• HTTP requests to /maxtime/api/database/database.lua containing ../, ..%2f, or encoded traversal sequences in query parameters
• Successful HTTP 200 responses to database.lua returning non-database file content such as /etc/passwd or configuration files
• Authenticated sessions issuing abnormal volumes of requests to the database API endpoint

Detection Strategies

• Inspect web server and reverse proxy access logs for traversal patterns targeting the MaxTime API paths
• Deploy web application firewall rules that reject path traversal metacharacters on MaxTime endpoints
• Correlate authenticated user activity with file access patterns inconsistent with normal operator workflows

Monitoring Recommendations

• Forward MaxTime application and web server logs to a central SIEM for retention and alerting
• Alert on repeated 4xx or anomalous 2xx responses from database.lua with path-like parameters
• Monitor authenticated account behavior for off-hours access or geographic anomalies against the MaxTime interface

How to Mitigate CVE-2025-26357

Immediate Actions Required

• Upgrade Q-Free MaxTime to a version released after 2.11.0 that addresses the traversal flaw
• Restrict network access to the MaxTime web interface to trusted management networks only
• Rotate credentials for all MaxTime accounts and any secrets that may have been exposed via file disclosure
• Review authentication logs for suspicious access preceding the patch date

Patch Information

Q-Free addresses the issue in releases subsequent to version 2.11.0. Consult the Nozomi Networks Vulnerability Advisory CVE-2025-26357 and Q-Free product support for the fixed version and upgrade procedure applicable to your deployment.

Workarounds

• Place the MaxTime web interface behind a VPN or jump host to limit exposure to authenticated attackers
• Apply reverse proxy or WAF rules that block requests to maxtime/api/database/database.lua containing traversal sequences
• Enforce least-privilege account policies and disable or remove unused MaxTime user accounts

# Example nginx rule to block path traversal attempts against the vulnerable endpoint
location ~* /maxtime/api/database/database\.lua {
    if ($args ~* "(\.\./|\.\.%2[fF]|%2[eE]%2[eE]/)") {
        return 403;
    }
    proxy_pass http://maxtime_backend;
}