CVE-2025-4769: CBEWIN Anytxt Searcher Path Traversal

CVE-2025-4769 Overview

CVE-2025-4769 is an uncontrolled search path vulnerability [CWE-426] in CBEWIN Anytxt Searcher version 1.3.1128.0. The flaw resides in the ATService.exe component, which loads dependencies from directories that a local attacker can influence. Successful exploitation allows a local, authenticated user to execute code in the context of the service and escalate privileges on the affected host. The attack complexity is high and exploitation requires local access, but the impact on confidentiality, integrity, and availability is significant.

Critical Impact
A local attacker with low privileges can hijack the service search path to load an attacker-controlled binary through ATService.exe, resulting in code execution at the service's privilege level.

Affected Products

CBEWIN Anytxt Searcher 1.3.1128.0
Component: ATService.exe
Deployments on Windows hosts where the service runs with elevated privileges

Discovery Timeline

2025-05-16 - CVE-2025-4769 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4769

Vulnerability Analysis

The vulnerability is classified as an uncontrolled search path element [CWE-426]. The ATService.exe binary shipped with CBEWIN Anytxt Searcher 1.3.1128.0 resolves dependencies (such as DLLs or referenced executables) without fully qualifying their paths. When the service starts, Windows walks the standard search order, which includes directories that lower-privileged users may be able to write to or influence.

A local attacker who can place a malicious binary in one of these search locations causes the service to load the attacker-controlled file. Because ATService.exe typically runs as a background service, the loaded code executes with the service account's privileges. The attack vector is local and requires low privileges, but the exploitation path is non-trivial and depends on filesystem permissions and service configuration on the target host.

Root Cause

The root cause is the failure to use fully qualified paths when the service loads its dependencies. The application relies on the Windows library search order rather than explicitly specifying trusted absolute paths, allowing an untrusted directory to be searched before the intended one.

Attack Vector

Exploitation requires local access with a valid user account on the system. The attacker plants a crafted binary — for example a DLL matching the name of one loaded by ATService.exe — in a directory that appears earlier in the resolution order than the legitimate location. When the service starts or restarts, it loads the malicious module and executes the attacker's code with the service's privileges.

No verified public proof-of-concept code is available. Refer to the VulDB vulnerability listing and the Yuque security documentation for additional technical detail.

Detection Methods for CVE-2025-4769

Indicators of Compromise

Unexpected DLL or executable files present in the installation directory of Anytxt Searcher or in directories referenced by the service's search order.
New or modified files created by a low-privileged user in directories from which ATService.exe loads modules.
Child processes spawned by ATService.exe that do not match the vendor's expected process tree.

Detection Strategies

Monitor module load events for ATService.exe and alert when modules load from non-standard or user-writable directories.
Baseline the legitimate file set inside the Anytxt installation folder and flag deviations, including newly introduced DLLs with names matching Windows or vendor libraries.
Correlate service start and restart events with recent filesystem writes by non-administrative users.

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image Loaded) and Event ID 1 (Process Create) for the ATService.exe process.
Audit filesystem ACLs on the Anytxt Searcher installation directory and any parent directories that are user-writable.
Track service configuration changes and unquoted or relative path references via Windows Service audit events.

How to Mitigate CVE-2025-4769

Immediate Actions Required

Restrict write access to the Anytxt Searcher installation directory and any directories in the service's binary search path to administrators only.
Stop or disable the Anytxt Searcher service on hosts where it is not required until a vendor patch is available.
Inventory endpoints running CBEWIN Anytxt Searcher 1.3.1128.0 and prioritize systems where users have local logon rights.

Patch Information

At the time of publication, no vendor patch or fixed version is referenced in the NVD entry for CVE-2025-4769. Monitor the VulDB CTI resource and vendor channels for updated release information, and apply any patched version as soon as it is published.

Workarounds

Remove ATService.exe from automatic startup and run Anytxt Searcher only under accounts that do not hold elevated privileges.
Apply strict NTFS permissions to the installation directory to prevent non-administrative users from placing or modifying files.
Use application control tools (such as Windows Defender Application Control or AppLocker) to block loading of unsigned or unexpected modules by ATService.exe.

bash

# Configuration example: audit and restrict write access on the install directory
icacls "C:\Program Files\Anytxt" /inheritance:r
icacls "C:\Program Files\Anytxt" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
sc.exe qc AnytxtService