CVE-2025-26353

Summary

CVE-2025-26353 is a newly disclosed vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. This issue, classified as a CWE-35 "Path Traversal" vulnerability, enables authenticated attackers to access sensitive files through crafted HTTP requests. By exploiting this flaw, adversaries can potentially obtain confidential data, posing a significant risk to system security. The vulnerability exists in the maxtime/api/sql/sql.lua module. Upgrading to the latest version is strongly recommended to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.