CVE-2025-53880

🗓️ 30 Oct 2025 10:31:15Reported by suseType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

CVE-2025-53880 path traversal in tftpsync add/delete enables remote file creation/deletion as wwwrun; unauthenticated but IP-limited.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2025-53880	30 Oct 202512:29	–	circl
CNNVD	SUSE多款产品安全漏洞	30 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-53880 susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal	30 Oct 202510:31	–	cvelist
EUVD	EUVD-2025-36998	30 Oct 202510:31	–	euvd
NVD	CVE-2025-53880	30 Oct 202511:15	–	nvd
OSV	SUSE-SU-2025:3827-1 Security update 4.3.16.1 for SUSE Manager Server Release Notes	28 Oct 202507:26	–	osv
Positive Technologies	PT-2025-44397	30 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-53880	7 Nov 202519:58	–	redhatcve
SUSE Linux	Security update 5.0.5.1 for for Multi-Linux Manager	28 Oct 202507:26	–	suse
SUSE Linux	Security update 4.3.16.1 SUSE Manager Server and Proxy 4.3 LTS	28 Oct 202507:26	–	suse

[
  {
    "defaultStatus": "unaffected",
    "packageName": "susemanager-tftpsync-recv",
    "product": "Container suse/manager/4.3/proxy-httpd:latest",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "4.3.11-150400.3.15.3",
        "status": "affected",
        "version": "?",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "packageName": "susemanager-tftpsync-recv",
    "product": "Container suse/manager/5.0/x86_64/proxy-httpd:latest",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "5.0.3-150600.3.6.4",
        "status": "affected",
        "version": "?",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "packageName": "susemanager-tftpsync-recv",
    "product": "Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:latest",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "5.1.3-150700.3.3.3",
        "status": "affected",
        "version": "?",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "packageName": "susemanager-tftpsync-recv",
    "product": "SUSE Manager Proxy LTS 4.3",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "4.3.11-150400.3.15.3",
        "status": "affected",
        "version": "?",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.suse.com/show_bug.cgi

Parameter	Position	Path	Description	CWE
path	path	/tftpsync/add	Path traversal vulnerability in tftpsync/add endpoint allowing writing files outside the intended directory.	CWE-35
path	path	/tftpsync/delete	Path traversal vulnerability in tftpsync/delete endpoint allowing deletion of files outside the intended directory.	CWE-35

15 Apr 2026 00:35Current

6.5Medium risk

Vulners AI Score6.5

CVSS 48.7

EPSS0.00466

SSVC

CWE-35