CVE-2025-11466

Vulnerability

Analysis

The vulnerability, reported as ZDI-CAN-27136 [1], exists in the DatabaseBackupBL class of Allegra. The root cause is insufficient validation of user-supplied paths before using them in file operations. This directory traversal flaw enables an authenticated attacker to read arbitrary files on the system. The CVSS v3 base score is 4.9 (Medium), with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating a high confidentiality impact but requiring high privileges.

Exploitation

An attacker with valid authentication can exploit this flaw remotely by manipulating a path input that is used in file operations without proper sanitization. The lack of path validation allows traversal outside the intended directory. The attack complexity is low, and no user interaction is required.

Impact

Successful exploitation leads to information disclosure in the context of the service account. An attacker could read sensitive files such as configuration data, database backups, or other confidential information stored on the server, potentially leading to further compromise.

Mitigation

Allegra has addressed this vulnerability in version 8.1.6 and the corresponding 7.5.2.76 release, as noted in the vendor's release notes [2]. Users are advised to update to these or later versions and clear their browser cache after upgrading.