CVE-2026-25760: Sliver C2 Path Traversal Vulnerability

CVE-2026-25760 Overview

CVE-2026-25760 is a path traversal vulnerability discovered in Sliver, a popular command and control (C2) framework developed by BishopFox that utilizes a custom Wireguard netstack. Prior to version 1.6.11, a path traversal flaw in the website content subsystem allows an authenticated operator to read arbitrary files on the Sliver server host. This vulnerability poses significant risks as it can expose sensitive credentials, configuration files, and cryptographic keys stored on the compromised server.

Critical Impact

An authenticated attacker can leverage this path traversal vulnerability to read sensitive files from the Sliver server, potentially exposing credentials, configuration data, and encryption keys that could be used for further attacks.

Affected Products

• Sliver C2 Framework versions prior to 1.6.11
• BishopFox Sliver installations with the website content subsystem enabled

Discovery Timeline

• 2026-02-06 - CVE-2026-25760 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25760

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as a path traversal or directory traversal vulnerability. The flaw exists in the website content subsystem of the Sliver C2 framework, where user-controlled path data was improperly handled during file read operations.

The core issue lies in how the ToProtobuf() function in server/db/models/website.go constructs file paths when serving website content. The original implementation directly used the webcontent.Path variable in the filepath.Join() call, which allowed authenticated operators to manipulate the path to escape the intended directory and access arbitrary files on the server filesystem.

Root Cause

The root cause of this vulnerability stems from improper input validation in the path construction logic. The vulnerable code used webcontent.Path directly in the file path construction, which could contain path traversal sequences such as ../ that allow directory escape. The fix replaces the user-controlled webcontent.Path with webcontent.ID.String(), which is a controlled identifier that cannot be manipulated to perform path traversal attacks.

Attack Vector

The attack requires network access and authentication to the Sliver server. An authenticated operator can exploit this vulnerability by crafting malicious requests to the website content subsystem with path traversal sequences embedded in the path parameter. When processed by the vulnerable ToProtobuf() function, these sequences allow the attacker to navigate outside the intended webContentDir directory and read arbitrary files from the server filesystem.

Successful exploitation could allow an attacker to:

• Read server configuration files containing sensitive settings
• Access stored credentials and API keys
• Obtain cryptographic keys used for C2 communication
• Gather reconnaissance data for further attacks

// Security patch from server/db/models/website.go
// Source: https://github.com/BishopFox/sliver/commit/818127349ccec812876693c4ca74ebf4350ec6b7

 func (w *Website) ToProtobuf(webContentDir string) *clientpb.Website {
 	WebContents := map[string]*clientpb.WebContent{}
 	for _, webcontent := range w.WebContents {
-		contents, _ := os.ReadFile(filepath.Join(webContentDir, webcontent.Path))
+		contents, err := os.ReadFile(filepath.Join(webContentDir, webcontent.ID.String()))
+		if err != nil {
+			continue
+		}
 		WebContents[webcontent.ID.String()] = webcontent.ToProtobuf(&contents)
 	}
 	return &clientpb.Website{

Source: GitHub Commit

Detection Methods for CVE-2026-25760

Indicators of Compromise

• Unusual file access patterns on the Sliver server, particularly access to files outside the web content directory
• Log entries showing requests with path traversal sequences such as ../ in website content paths
• Unexpected reads of sensitive files like /etc/passwd, configuration files, or key files

Detection Strategies

• Monitor Sliver server logs for suspicious path patterns containing directory traversal sequences
• Implement file integrity monitoring on sensitive configuration files and directories
• Review access logs for authenticated operators accessing unexpected file paths
• Deploy endpoint detection rules to identify path traversal attack patterns

Monitoring Recommendations

• Enable verbose logging on Sliver server instances to capture detailed request information
• Set up alerts for file access operations outside designated content directories
• Monitor for unusual behavior from authenticated operator accounts
• Implement behavioral analysis to detect anomalous file read patterns

How to Mitigate CVE-2026-25760

Immediate Actions Required

• Upgrade all Sliver C2 installations to version 1.6.11 or later immediately
• Review server logs for any evidence of exploitation attempts
• Audit all files that may have been exposed, particularly credentials and configuration files
• Rotate any credentials or keys that may have been compromised
• Restrict network access to Sliver server instances while patching

Patch Information

The vulnerability has been fixed in Sliver version 1.6.11. The patch modifies the ToProtobuf() function in server/db/models/website.go to use the content ID instead of the user-controlled path for file operations, effectively preventing path traversal attacks. For detailed patch information, refer to the GitHub Security Advisory and the security commit.

Workarounds

• Disable the website content subsystem if not required for operations until patching is complete
• Implement network segmentation to limit access to Sliver server instances
• Apply strict access controls to limit which operators can interact with the website content feature
• Monitor and log all operator activities for forensic purposes

# Upgrade Sliver to patched version
# Download and install version 1.6.11 or later from the official repository
git clone https://github.com/BishopFox/sliver.git
cd sliver
git checkout v1.6.11
make