CVE-2025-61138: Qlik Sense Information Disclosure Flaw

CVE-2025-61138 Overview

CVE-2025-61138 is an information disclosure vulnerability affecting Qlik Sense Enterprise version 14.212.13. The flaw resides in the /dev-hub/ directory, which exposes information to unauthenticated remote users over the network. This issue is classified under [CWE-538] (Insertion of Sensitive Information into Externally-Accessible File or Directory).

The vulnerability allows attackers to retrieve sensitive content without authentication, user interaction, or elevated privileges. Affected organizations using Qlik Sense Enterprise for business intelligence and analytics workloads face exposure of internal application data through the publicly reachable development hub endpoint.

Critical Impact
Unauthenticated network attackers can access sensitive information exposed through the /dev-hub/ directory of Qlik Sense Enterprise 14.212.13, potentially exposing internal application data and configuration details.

Affected Products

Qlik Qlik Sense Enterprise 14.212.13
CPE: cpe:2.3:a:qlik:qlik_sense:14.212.13:*:*:*:enterprise:*:*:*
Component: qlik:qlik_sense

Discovery Timeline

2025-11-20 - CVE-2025-61138 published to NVD
2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-61138

Vulnerability Analysis

The vulnerability is an information leak in Qlik Sense Enterprise 14.212.13. The /dev-hub/ directory is a development-oriented endpoint shipped with the application. In the affected version, this directory returns content that should not be reachable by unauthenticated external clients.

Because the endpoint responds to direct HTTP requests without enforcing authentication checks, attackers can enumerate and retrieve exposed resources. The flaw maps to [CWE-538], where sensitive information is placed in a location accessible from outside the trust boundary.

The issue affects only confidentiality. Integrity and availability of the Qlik Sense Enterprise installation are not directly impacted by this specific weakness.

Root Cause

The root cause is the inclusion of a development-facing directory in the production deployment of Qlik Sense Enterprise without adequate access controls. The /dev-hub/ path is meant to support extension development and visualization prototyping. Shipping it as publicly reachable on production instances exposes resources that the application stores there.

Attack Vector

An attacker requires only network access to the Qlik Sense Enterprise web interface. The attacker issues HTTP requests to the /dev-hub/ path on the target host. No credentials, tokens, or user interaction are required. The response returns the leaked content, which the attacker can parse for sensitive material useful in reconnaissance or follow-on attacks.

Proof-of-concept details for this vulnerability have been published as a GitHub Gist PoC. No verified code examples are reproduced here; refer to the gist for request-level technical detail.

Detection Methods for CVE-2025-61138

Indicators of Compromise

Unauthenticated HTTP GET requests to the /dev-hub/ path on Qlik Sense Enterprise hosts originating from external or untrusted IP ranges.
Web server access logs showing repeated enumeration of resources under /dev-hub/ followed by file-specific retrievals.
HTTP 200 responses to /dev-hub/ requests from sessions that did not previously authenticate to Qlik Sense.

Detection Strategies

Monitor reverse proxy and Qlik Sense web logs for anonymous access patterns targeting /dev-hub/ and adjacent development endpoints.
Correlate requests to /dev-hub/ with source IP geolocation and known scanner user-agent strings to identify reconnaissance.
Compare baseline traffic for internal Qlik Sense deployments against external access attempts to surface unauthorized exposure.

Monitoring Recommendations

Centralize Qlik Sense web logs in a SIEM or data lake and alert on unauthenticated access to /dev-hub/.
Track outbound responses from /dev-hub/ for unusually large payload sizes that may indicate bulk content extraction.
Review external attack-surface scans to confirm whether the Qlik Sense /dev-hub/ path is reachable from the internet.

How to Mitigate CVE-2025-61138

Immediate Actions Required

Restrict network access to Qlik Sense Enterprise so that the /dev-hub/ directory is reachable only from trusted administrative networks.
Confirm the running version of Qlik Sense Enterprise and identify any hosts on 14.212.13 that are exposed to the internet.
Review web server logs for prior anonymous access to /dev-hub/ to determine whether information disclosure has already occurred.

Patch Information

No vendor patch reference is included in the available CVE data at the time of writing. Administrators should consult the Qlik vendor support portal and security advisories for the latest fixed version that addresses CVE-2025-61138. Additional technical context is available in the published GitHub Gist PoC.

Workarounds

Block access to the /dev-hub/ path at the reverse proxy, web application firewall, or load balancer until an official fix is applied.
Place Qlik Sense Enterprise behind a VPN or zero-trust gateway so unauthenticated internet users cannot reach the application directly.
Disable or remove development hub functionality on production servers if it is not required for business operations.

bash

# Example nginx reverse proxy rule blocking access to the vulnerable path
location ~* ^/dev-hub/ {
    deny all;
    return 403;
}