CVE-2025-7719: GE Vernova Smallworld Path Traversal Flaw

CVE-2025-7719 Overview

CVE-2025-7719 is a path traversal vulnerability in GE Vernova Smallworld affecting versions 5.3.5 and earlier on Windows and Linux. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. An authenticated attacker with network access can manipulate files outside intended directories by supplying crafted path sequences. GE Vernova disclosed the issue in its Smallworld Arbitrary File Operations Security Advisory.

Critical Impact
Authenticated attackers can read, write, or delete files outside the intended directory structure, impacting confidentiality, integrity, and availability of the Smallworld environment.

Affected Products

GE Vernova Smallworld 5.3.5 and prior versions
Smallworld deployments on Windows
Smallworld deployments on Linux

Discovery Timeline

2025-11-07 - CVE-2025-7719 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-7719

Vulnerability Analysis

The vulnerability resides in file-handling logic within GE Vernova Smallworld. The application accepts file path parameters without properly validating or canonicalizing them against a restricted base directory. An attacker with low privileges on the network can submit relative path sequences such as ../ to traverse outside the intended directory. Successful exploitation allows file manipulation operations against arbitrary locations the Smallworld process can access.

Smallworld is a geospatial platform used by utilities and telecommunications operators for network asset management. File manipulation against configuration files, map data, or system files can disrupt operations and expose sensitive information. Refer to the GE Vernova Security Advisory for vendor-provided impact details.

Root Cause

The root cause is missing or insufficient input validation on user-supplied file paths. The application does not reject or normalize sequences that resolve outside the restricted base directory. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack vector is network-based and requires low-level privileges. No user interaction is required. An authenticated attacker sends requests containing manipulated path parameters to the vulnerable Smallworld service. Technical exploitation details are documented in the vendor advisory; no public proof-of-concept code has been published.

Detection Methods for CVE-2025-7719

Indicators of Compromise

Requests to Smallworld services containing path traversal sequences such as ../, ..\, URL-encoded %2e%2e%2f, or double-encoded variants
Unexpected file reads, writes, or deletions outside the Smallworld application data directories
Anomalous file access patterns performed by the Smallworld service account on Windows or Linux hosts

Detection Strategies

Inspect application and web server logs for path parameters containing traversal sequences targeting Smallworld endpoints
Deploy file integrity monitoring on Smallworld installation directories and system configuration locations
Correlate authenticated Smallworld session activity with file system telemetry to identify abnormal access outside expected paths

Monitoring Recommendations

Forward Smallworld application logs and host file system telemetry to a centralized analytics platform for correlation
Alert on write or delete operations by the Smallworld service account outside its designated working directories
Baseline normal file access patterns for Smallworld processes and alert on deviations

How to Mitigate CVE-2025-7719

Immediate Actions Required

Review the GE Vernova Smallworld Security Advisory and apply vendor-recommended updates
Inventory all Smallworld deployments running version 5.3.5 or earlier on Windows and Linux
Restrict network access to Smallworld services so only trusted operational networks can reach them
Audit Smallworld user accounts and revoke unnecessary privileges to reduce the attacker pool

Patch Information

GE Vernova has published remediation guidance in its security advisory covering arbitrary file operations in SWMFS. Operators should contact GE Vernova support to obtain the fixed Smallworld release and follow the vendor's upgrade procedure. Consult the Smallworld Security Advisory PDF for version-specific instructions.

Workarounds

Place Smallworld services behind network segmentation and VPN access to limit exposure to authenticated network users only
Run the Smallworld service account with the minimum file system permissions required for operation
Apply web application firewall or reverse proxy rules that block requests containing path traversal sequences targeting Smallworld endpoints
Enable host-based access controls such as AppArmor, SELinux, or Windows ACLs to constrain file operations by the Smallworld process

bash

# Example WAF rule concept to block common path traversal patterns
# Adjust for your WAF syntax and Smallworld endpoint paths
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)" \
    "id:1007719,phase:2,deny,status:403,log,msg:'CVE-2025-7719 path traversal attempt'"