CVE-2025-66955: Asseco SEE Live Path Traversal Flaw

CVE-2025-66955 Overview

A Local File Inclusion (LFI) vulnerability has been identified in Asseco SEE Live 2.0, specifically affecting the Contact Plan, E-Mail, SMS, and Fax components. This vulnerability allows remote authenticated users to access arbitrary files on the host system by manipulating the path parameter in the downloadAttachment and downloadAttachmentFromPath API calls. Successful exploitation could lead to unauthorized access to sensitive configuration files, credentials, or other critical system data stored on the server.

Critical Impact

Remote authenticated attackers can read arbitrary files from the server filesystem, potentially exposing sensitive configuration data, credentials, and private information through malicious path parameter manipulation.

Affected Products

• Asseco SEE Live 2.0
• Contact Plan component in Asseco SEE Live 2.0
• E-Mail, SMS, and Fax components in Asseco SEE Live 2.0

Discovery Timeline

• 2026-03-12 - CVE CVE-2025-66955 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-66955

Vulnerability Analysis

This Local File Inclusion vulnerability exists within the attachment download functionality of Asseco SEE Live 2.0. The affected API endpoints (downloadAttachment and downloadAttachmentFromPath) fail to properly validate and sanitize the path parameter before using it to retrieve files from the server filesystem. This inadequate input validation allows authenticated attackers to traverse outside the intended directory structure and access files elsewhere on the system.

The vulnerability is particularly concerning because it affects multiple core communication components (Contact Plan, E-Mail, SMS, and Fax), suggesting a shared vulnerable codebase or library across these features. While authentication is required to exploit this flaw, any user with valid credentials to the Asseco SEE Live platform could potentially leverage this weakness to read sensitive files.

Root Cause

The root cause of this vulnerability is improper input validation of the path parameter in the attachment download API endpoints. The application fails to implement adequate path canonicalization and directory traversal prevention measures. When a user supplies a path containing directory traversal sequences (such as ../), the application processes the request without proper sanitization, allowing the attacker to escape the intended attachment directory and access arbitrary files on the filesystem that the application has read permissions for.

Attack Vector

An authenticated attacker can exploit this vulnerability by crafting malicious API requests to the downloadAttachment or downloadAttachmentFromPath endpoints with specially crafted path parameter values. By including directory traversal sequences in the path parameter, the attacker can navigate outside the designated attachment storage directory and access sensitive files on the server.

For example, an attacker might target common sensitive files such as /etc/passwd, application configuration files containing database credentials, or other confidential data accessible to the web application process. The attack requires only valid authentication credentials to the Asseco SEE Live platform, making it exploitable by any authenticated user including those with minimal privileges.

Detailed technical exploitation information can be found in the GitHub CVE-2025-66955 Repository.

Detection Methods for CVE-2025-66955

Indicators of Compromise

• HTTP requests to downloadAttachment or downloadAttachmentFromPath endpoints containing path traversal sequences (../, ..\\, or URL-encoded variants like %2e%2e%2f)
• Unusual access patterns to the attachment download APIs from authenticated user accounts
• Server logs showing requests for system files (e.g., /etc/passwd, configuration files) through the attachment download functionality
• Abnormal data exfiltration patterns or large file downloads through the affected API endpoints

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in API requests to the affected endpoints
• Configure application logging to capture full request parameters for the downloadAttachment and downloadAttachmentFromPath API calls
• Deploy file integrity monitoring on sensitive system files to detect unauthorized access attempts
• Use SIEM correlation rules to identify repeated path traversal attempts from the same user or source IP

Monitoring Recommendations

• Enable detailed logging for all attachment-related API endpoints in Asseco SEE Live 2.0
• Monitor for anomalous file access patterns, particularly requests attempting to access files outside the attachment directory
• Set up alerts for authentication followed by suspicious API activity patterns
• Review web server access logs regularly for path traversal indicators in the request URI or parameters

How to Mitigate CVE-2025-66955

Immediate Actions Required

• Restrict access to the Asseco SEE Live 2.0 application to trusted users only until a patch is available
• Implement WAF rules to block requests containing path traversal sequences targeting the affected API endpoints
• Review application logs for evidence of prior exploitation attempts
• Consider temporarily disabling the downloadAttachment and downloadAttachmentFromPath functionality if business operations permit

Patch Information

No official vendor patch information is currently available. Organizations should monitor the Asseco website for security updates and advisories related to this vulnerability. Additional technical details may be available in the GitHub CVE-2025-66955 Repository.

Workarounds

• Implement strict input validation on the server side to reject any path parameter containing traversal sequences
• Deploy network-level access controls to limit which users and IP addresses can access the affected API endpoints
• Use a reverse proxy or WAF to filter and sanitize incoming requests before they reach the application
• Apply the principle of least privilege to the application's filesystem permissions, limiting which files the application process can access

# Example WAF rule to block path traversal attempts (ModSecurity format)
SecRule ARGS:path "@contains ../" "id:100001,phase:2,deny,status:403,msg:'Path traversal attempt blocked'"
SecRule ARGS:path "@contains %2e%2e%2f" "id:100002,phase:2,deny,status:403,msg:'Encoded path traversal attempt blocked'"