CVE-2025-26355

Summary

CVE-2025-26355 is a newly disclosed vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. This issue, classified as a CWE-35 "Path Traversal" vulnerability, enables authenticated remote attackers to delete sensitive files through crafted HTTP requests. By manipulating the file path during database interactions within the api/database/database.lua file, adversaries can potentially destroy critical data or disrupt system functionality. This vulnerability poses a significant risk, especially in environments where access control measures are weak or compromised. System administrators are strongly advised to upgrade to the latest version of Q-Free MaxTime to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.