CVE-2026-25575: NavigaTUM Path Traversal Vulnerability

CVE-2026-25575 Overview

CVE-2026-25575 is a path traversal vulnerability in NavigaTUM, a website and API designed to search for rooms, buildings, and other places. The vulnerability exists in the propose_edits endpoint, which allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public-facing images or fill the server's storage.

Critical Impact

Unauthenticated attackers can exploit this path traversal vulnerability to overwrite critical files, potentially defacing the website or causing denial of service through storage exhaustion.

Affected Products

• NavigaTUM (versions prior to commit 86f34c7)

Discovery Timeline

• 2026-02-04 - CVE-2026-25575 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25575

Vulnerability Analysis

This vulnerability is classified as CWE-23 (Relative Path Traversal), a subset of path traversal vulnerabilities where user-controlled input containing relative path sequences is not properly sanitized before being used in file operations. The propose_edits endpoint accepts JSON payloads containing file keys, but fails to validate or sanitize these keys for directory traversal sequences.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without any authentication or user interaction. The primary impact is to the integrity of the system, allowing arbitrary file writes to any directory the application user has write permissions on. Additionally, by repeatedly uploading large files, an attacker could exhaust server storage capacity, leading to availability issues.

Root Cause

The root cause is improper input validation in the propose_edits endpoint. The application accepts file key parameters from user-supplied JSON payloads without sanitizing path traversal sequences such as ../ or ..\\. This allows attackers to construct file paths that escape the intended temporary upload directory and write to arbitrary locations within the application user's writable directories.

Attack Vector

The attack is executed over the network by sending a crafted HTTP request to the propose_edits endpoint. The attacker includes malicious file keys in the JSON payload containing path traversal sequences. For example, a file key like ../../cdn/images/logo.png would escape the temporary directory and target the CDN images directory.

The attack requires no authentication or special privileges, and no user interaction is needed. An attacker could:

1. Deface public-facing content by overwriting images in the /cdn directory
2. Potentially overwrite configuration files if the application user has write access
3. Exhaust storage capacity by uploading numerous large files to various directories

For detailed technical information about this vulnerability and the fix implementation, see the GitHub Security Advisory and the related pull request.

Detection Methods for CVE-2026-25575

Indicators of Compromise

• HTTP requests to the propose_edits endpoint containing ../ or ..\\ sequences in JSON payload keys
• Unexpected file modifications in the /cdn directory or other writable locations
• Sudden increase in disk usage without corresponding legitimate activity
• Modified or replaced image files in public-facing directories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal sequences in request payloads
• Monitor file integrity for unexpected changes in the /cdn and other application directories
• Analyze application logs for requests to the propose_edits endpoint with suspicious file key patterns
• Deploy intrusion detection systems (IDS) with signatures for directory traversal attacks

Monitoring Recommendations

• Enable verbose logging for the propose_edits endpoint to capture all incoming file key parameters
• Set up file integrity monitoring (FIM) alerts for critical directories writable by the application user
• Monitor disk usage metrics for unusual spikes that could indicate storage exhaustion attacks
• Implement rate limiting on the propose_edits endpoint to slow down potential exploitation attempts

How to Mitigate CVE-2026-25575

Immediate Actions Required

• Update NavigaTUM to a version that includes commit 86f34c7 or later
• Review server logs for any evidence of exploitation attempts targeting the propose_edits endpoint
• Verify the integrity of files in the /cdn directory and other writable locations
• Consider temporarily disabling the propose_edits functionality if an immediate update is not possible

Patch Information

This vulnerability has been patched in commit 86f34c7. The fix implements proper input sanitization to prevent path traversal sequences from escaping the intended upload directory. Organizations running NavigaTUM should update to a version containing this commit immediately.

Additional details about the fix are available in pull request #2650.

Workarounds

• Implement a reverse proxy or WAF rule to filter requests containing path traversal sequences (../, ..\\, %2e%2e/, etc.) in the request body
• Restrict file system permissions for the application user to limit the impact of potential exploitation
• Temporarily disable the propose_edits endpoint if it is not business-critical while awaiting patch deployment
• Implement network-level access controls to restrict access to the propose_edits endpoint to trusted IP ranges

# Example: Nginx configuration to block path traversal attempts
# Add to your server block configuration
location /api/propose_edits {
    if ($request_body ~* "\.\.\/") {
        return 403;
    }
    # Additional restrictions
    limit_req zone=propose_edits burst=5 nodelay;
    proxy_pass http://navigatum_backend;
}