CVE-2025-41428 Overview
CVE-2025-41428 is a path traversal vulnerability [CWE-22] affecting Keiyo System TimeWorks versions 10.0 through 10.3. The flaw allows a remote, unauthenticated attacker to read arbitrary JSON files on the server by manipulating file path parameters. Exploitation requires no privileges and no user interaction, and the attack can be delivered over the network.
Critical Impact
Unauthenticated remote attackers can retrieve arbitrary JSON files from the server file system, potentially exposing configuration data, application state, or sensitive business records handled by the TimeWorks application.
Affected Products
- Keiyo System TimeWorks 10.0
- Keiyo System TimeWorks 10.1 through 10.2
- Keiyo System TimeWorks 10.3
Discovery Timeline
- 2025-06-03 - CVE-2025-41428 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41428
Vulnerability Analysis
The vulnerability stems from improper limitation of a pathname to a restricted directory in TimeWorks 10.0 to 10.3. The application accepts a file identifier or path parameter and uses it to locate JSON resources on the server without adequately validating or canonicalizing the input. An attacker can supply traversal sequences to escape the intended directory and read JSON files stored elsewhere on the host.
Because the affected endpoint does not require authentication, exploitation can be attempted directly against any exposed TimeWorks instance. The confidentiality impact is limited to JSON file contents, but those files may include configuration data, session data, or business records depending on deployment. Integrity and availability are not directly affected.
Root Cause
The root cause is missing or insufficient input validation on a file path parameter. The application resolves user-controlled input to a filesystem location without enforcing a canonical base directory, rejecting .. sequences, or applying an allow-list of expected filenames. This matches the pattern described in CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
The attack is delivered over the network against the TimeWorks HTTP interface. An unauthenticated attacker crafts a request containing directory traversal sequences in the parameter used to select a JSON resource. The server processes the traversed path and returns the contents of the targeted JSON file. Further technical details are provided in the JVN Security Advisory JVN37075430 and the Keiyo System Security Notice.
Detection Methods for CVE-2025-41428
Indicators of Compromise
- HTTP requests to TimeWorks endpoints containing ../, ..\\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in query or path parameters.
- Web server access logs showing unauthenticated requests that reference JSON file paths outside the expected application directory.
- Unexpected reads of JSON configuration or data files by the TimeWorks application process.
Detection Strategies
- Inspect web server and reverse proxy logs for path traversal patterns targeting TimeWorks URLs.
- Deploy web application firewall rules that block traversal sequences in parameters accepted by TimeWorks.
- Correlate 200-status responses to unauthenticated requests that return JSON payloads with anomalous filenames.
Monitoring Recommendations
- Enable verbose access logging on the TimeWorks web tier and forward logs to a centralized analytics platform.
- Alert on repeated requests from a single source that contain encoded or nested traversal patterns.
- Monitor filesystem audit events for reads of JSON files by the TimeWorks service account outside its installation directory.
How to Mitigate CVE-2025-41428
Immediate Actions Required
- Identify all TimeWorks 10.0 through 10.3 instances exposed to untrusted networks and restrict access to trusted sources only.
- Apply the vendor-supplied fix referenced in the Keiyo System Security Notice as soon as it is available for your version.
- Deploy WAF signatures that reject requests containing directory traversal sequences targeting TimeWorks endpoints.
Patch Information
Keiyo System has published a security notice covering TimeWorks 10.0 to 10.3. Refer to the Keiyo System Security Notice and the JVN Security Advisory JVN37075430 for fixed version details and upgrade guidance.
Workarounds
- Place TimeWorks behind an authenticated reverse proxy or VPN to remove unauthenticated network exposure.
- Configure a WAF rule to drop requests containing ../, ..\\, %2e%2e%2f, or %2e%2e/ in query strings or path segments directed at TimeWorks.
- Restrict the TimeWorks service account so it can only read files within the intended application data directory.
# Example ModSecurity rule to block path traversal attempts against TimeWorks
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|%2e%2e\\)" \
"id:1004128,phase:2,deny,status:403,log,msg:'CVE-2025-41428 TimeWorks path traversal attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
