CVE-2025-2264

🗓️ 13 Mar 2025 16:29:07Reported by tenableType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 145 Views🌐 WEB

Path Traversal vulnerability in Sante PACS Server allows remote attackers to download files.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2025-2264	13 Mar 202516:45	–	circl
CNNVD	Santesoft Sante PACS Server 安全漏洞	13 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-2264 Santesoft Sante PACS Server Path Traversal Information Disclosure	13 Mar 202516:29	–	cvelist
Metasploit	Sante PACS Server Path Traversal (CVE-2025-2264)	13 Mar 202500:00	–	metasploit
Nuclei	Sante PACS Server.exe - Path Traversal Information Disclosure	12 Oct 202602:21	–	nuclei
NVD	CVE-2025-2264	13 Mar 202517:15	–	nvd
OpenVAS	Generic HTTP Directory Traversal / File Inclusion (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas
OSV	CVE-2025-2264	13 Mar 202517:15	–	osv
Positive Technologies	PT-2025-11207 · Unknown · Sante Pacs Server.Exe	13 Mar 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-2264: Improper Limitation of a Pathname to a Restricted Directory	13 Mar 202500:00	–	rapid7

NVD

Vulners

Node

santesoft sante_pacs_serverMatch4.1.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Sante PACS Server",
    "vendor": "Santesoft",
    "versions": [
      {
        "status": "affected",
        "version": "4.1.0"
      },
      {
        "status": "unaffected",
        "version": "4.2.0"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2025-08

Parameter	Position	Path	Description	CWE
FILE	path	/assets/../../../.HTTP/HTTP.db	Path traversal via the assets endpoint allowing an attacker to read arbitrary files on the server by crafting the traversal path.	CWE-22
DEPTH	path	/assets/../../../.HTTP/HTTP.db	Path traversal via the assets endpoint allowing an attacker to read arbitrary files on the server by crafting the traversal path.	CWE-22

17 Jun 2026 09:06Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.35383

SSVC