CVE-2025-59099: Access Manager Path Traversal Flaw

CVE-2025-59099 Overview

CVE-2025-59099 is a path traversal vulnerability affecting the Access Manager, which utilizes the open source CompactWebServer written in C#. This vulnerability allows unauthenticated attackers to directly access arbitrary files on the file system via simple GET requests without any prior authentication. The vulnerability enables retrieval of sensitive files including the SQLite database Database.sq3, which contains badge information and corresponding PIN codes. Additionally, accessing certain files causes the web server to crash and become unreachable for approximately 60 seconds, enabling attackers to chain requests for sustained denial of service.

Critical Impact

Unauthenticated attackers can exfiltrate sensitive badge credentials and PIN codes from the SQLite database, while also disrupting access control system availability through repeated crash-inducing requests.

Affected Products

• Access Manager using CompactWebServer
• Systems utilizing the open source CompactWebServer written in C#
• Physical access control systems with exposed web management interfaces

Discovery Timeline

• 2026-01-26 - CVE-2025-59099 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-59099

Vulnerability Analysis

This path traversal vulnerability (CWE-35) exists in the CompactWebServer component used by the Access Manager. The web server fails to properly sanitize user-supplied input in HTTP GET requests, allowing attackers to use directory traversal sequences to escape the intended web root directory and access files anywhere on the file system. The vulnerability is particularly severe because it requires no authentication, allowing any network-adjacent attacker to immediately exploit the flaw.

The attack surface includes not only data exfiltration but also a denial of service condition. When specific files are requested through the path traversal technique, the web server crashes and requires approximately 60 seconds to recover. This crash behavior can be weaponized by continuously sending malicious requests to maintain a persistent denial of service state against the access management system.

Root Cause

The root cause is improper input validation in the CompactWebServer's file request handling logic. The server does not adequately sanitize or validate file path components in incoming GET requests, failing to detect and block traversal sequences such as ../ or encoded variants. This allows attackers to construct requests that navigate outside the web server's designated document root to access arbitrary files on the underlying file system.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP GET requests containing path traversal sequences to access files outside the intended web directory. The attack specifically targets the web server endpoint and can be executed remotely against any exposed Access Manager instance.

The path traversal payload enables access to sensitive files including Database.sq3, which stores badge credentials and PIN codes in SQLite format. The vulnerability also presents a denial of service vector where accessing certain files triggers a server crash, rendering the access control management interface unavailable for approximately 60 seconds per request.

For detailed technical information regarding exploitation techniques, see the SEC Consult DKAccess Advisory.

Detection Methods for CVE-2025-59099

Indicators of Compromise

• HTTP GET requests containing path traversal sequences such as ../, ..%2f, or %2e%2e/ targeting the Access Manager web server
• Access logs showing requests for Database.sq3 or other system files outside the web root
• Repeated web server crashes with approximately 60-second recovery intervals
• Unusual outbound data transfers from the Access Manager system containing database files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in incoming requests
• Monitor HTTP access logs for suspicious file access patterns, particularly requests containing directory traversal sequences
• Configure intrusion detection systems (IDS) to alert on multiple server restart events within short time periods
• Deploy file integrity monitoring on sensitive database files like Database.sq3

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to the Access Manager web interface
• Set up alerts for web server crash events and automatic restart occurrences
• Monitor for failed or suspicious authentication attempts following potential credential exfiltration
• Track network traffic patterns for large data transfers from the Access Manager to external destinations

How to Mitigate CVE-2025-59099

Immediate Actions Required

• Restrict network access to the Access Manager web interface to trusted IP addresses only
• Implement network segmentation to isolate physical access control systems from untrusted networks
• Deploy a reverse proxy or web application firewall with path traversal detection capabilities in front of the Access Manager
• Review access logs for evidence of prior exploitation attempts

Patch Information

Consult the vendor's security advisories for official patch information. The Dormakaba Security Advisories page provides information on available security updates. Additionally, review the SEC Consult Dormakaba Advisory for detailed remediation guidance.

Workarounds

• Place the Access Manager behind a reverse proxy that filters path traversal attempts
• Implement firewall rules to limit access to the web management interface to specific trusted IP addresses
• Consider disabling the web interface entirely if not operationally required until patches are available
• Enable rate limiting to mitigate the denial of service attack vector

# Example firewall rule to restrict Access Manager web interface access
# Limit access to management network only
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP