CVE-2026-25760: Sliver C2 Path Traversal Vulnerability

CVE-2026-25760 Overview

CVE-2026-25760 is a path traversal vulnerability discovered in Sliver, a popular command and control (C2) framework developed by BishopFox that utilizes a custom Wireguard netstack. Prior to version 1.6.11, a path traversal flaw in the website content subsystem allows an authenticated operator to read arbitrary files on the Sliver server host. This vulnerability poses significant risks as it can expose sensitive credentials, configuration files, and cryptographic keys stored on the compromised server.

Critical Impact
An authenticated attacker can leverage this path traversal vulnerability to read sensitive files from the Sliver server, potentially exposing credentials, configuration data, and encryption keys that could be used for further attacks.

Affected Products

Sliver C2 Framework versions prior to 1.6.11
BishopFox Sliver installations with the website content subsystem enabled

Discovery Timeline

2026-02-06 - CVE-2026-25760 published to NVD
2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25760

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as a path traversal or directory traversal vulnerability. The flaw exists in the website content subsystem of the Sliver C2 framework, where user-controlled path data was improperly handled during file read operations.

The core issue lies in how the ToProtobuf() function in server/db/models/website.go constructs file paths when serving website content. The original implementation directly used the webcontent.Path variable in the filepath.Join() call, which allowed authenticated operators to manipulate the path to escape the intended directory and access arbitrary files on the server filesystem.

Root Cause

The root cause of this vulnerability stems from improper input validation in the path construction logic. The vulnerable code used webcontent.Path directly in the file path construction, which could contain path traversal sequences such as ../ that allow directory escape. The fix replaces the user-controlled webcontent.Path with webcontent.ID.String(), which is a controlled identifier that cannot be manipulated to perform path traversal attacks.

Attack Vector

The attack requires network access and authentication to the Sliver server. An authenticated operator can exploit this vulnerability by crafting malicious requests to the website content subsystem with path traversal sequences embedded in the path parameter. When processed by the vulnerable ToProtobuf() function, these sequences allow the attacker to navigate outside the intended webContentDir directory and read arbitrary files from the server filesystem.

Successful exploitation could allow an attacker to:

Read server configuration files containing sensitive settings
Access stored credentials and API keys
Obtain cryptographic keys used for C2 communication
Gather reconnaissance data for further attacks

// Security patch from server/db/models/website.go
// Source: https://github.com/BishopFox/sliver/commit/818127349ccec812876693c4ca74ebf4350ec6b7

 func (w *Website) ToProtobuf(webContentDir string) *clientpb.Website {
 	WebContents := map[string]*clientpb.WebContent{}
 	for _, webcontent := range w.WebContents {
-		contents, _ := os.ReadFile(filepath.Join(webContentDir, webcontent.Path))
+		contents, err := os.ReadFile(filepath.Join(webContentDir, webcontent.ID.String()))
+		if err != nil {
+			continue
+		}
 		WebContents[webcontent.ID.String()] = webcontent.ToProtobuf(&contents)
 	}
 	return &clientpb.Website{

Source: GitHub Commit

Detection Methods for CVE-2026-25760

Indicators of Compromise

Unusual file access patterns on the Sliver server, particularly access to files outside the web content directory
Log entries showing requests with path traversal sequences such as ../ in website content paths
Unexpected reads of sensitive files like /etc/passwd, configuration files, or key files

Detection Strategies

Monitor Sliver server logs for suspicious path patterns containing directory traversal sequences
Implement file integrity monitoring on sensitive configuration files and directories
Review access logs for authenticated operators accessing unexpected file paths
Deploy endpoint detection rules to identify path traversal attack patterns

Monitoring Recommendations

Enable verbose logging on Sliver server instances to capture detailed request information
Set up alerts for file access operations outside designated content directories
Monitor for unusual behavior from authenticated operator accounts
Implement behavioral analysis to detect anomalous file read patterns

How to Mitigate CVE-2026-25760

Immediate Actions Required

Upgrade all Sliver C2 installations to version 1.6.11 or later immediately
Review server logs for any evidence of exploitation attempts
Audit all files that may have been exposed, particularly credentials and configuration files
Rotate any credentials or keys that may have been compromised
Restrict network access to Sliver server instances while patching

Patch Information

The vulnerability has been fixed in Sliver version 1.6.11. The patch modifies the ToProtobuf() function in server/db/models/website.go to use the content ID instead of the user-controlled path for file operations, effectively preventing path traversal attacks. For detailed patch information, refer to the GitHub Security Advisory and the security commit.

Workarounds

Disable the website content subsystem if not required for operations until patching is complete
Implement network segmentation to limit access to Sliver server instances
Apply strict access controls to limit which operators can interact with the website content feature
Monitor and log all operator activities for forensic purposes

bash

# Upgrade Sliver to patched version
# Download and install version 1.6.11 or later from the official repository
git clone https://github.com/BishopFox/sliver.git
cd sliver
git checkout v1.6.11
make