CVE-2025-26357

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...

CVE-2025-26356

CVE-2025-26356 affects Q-Free MaxTime

CVE-2025-26356

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua setActive endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26355

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

CVE-2025-26355

CVE-2025-26355 describes a CWE-35 path traversal in Q-Free MaxTime. The vulnerability resides in maxtime/api/database/database.lua and affects MaxTime versions less than or equal to 2.11.0. An authenticated remote attacker could delete sensitive files by crafting HTTP requests. The connected sour...

CVE-2025-26355

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

CVE-2025-26354

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26354

CVE-2025-26354 concerns Q-Free MaxTime

CVE-2025-26353

CVE-2025-26353 corresponds to a CWE-35 Path Traversal in Q-Free MaxTime

CVE-2025-26353

A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...

CVE-2025-26352

The CVE-2025-26352 entry documents a CWE-35 path traversal in the template deletion mechanism of Q-Free MaxTime (≤ v2.11.0). An authenticated remote attacker can delete sensitive files via crafted HTTP requests, due to the insecure handling in the deletion path. Impact is described as the ability...

CVE-2025-26352

A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

CVE-2025-26352

A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

CVE-2025-26351

CVE-2025-26351 describes a CWE-35 path traversal in the template download mechanism of Q-Free MaxTime (versions ≤ 2.11.0). An authenticated remote attacker can read sensitive files via crafted HTTP requests. Root cause: improper validation in the template download flow enabling path traversal. Im...

CVE-2025-26351

A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...

CVE-2025-26351

A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...

CVE-2025-26350

A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...

CVE-2025-26350

A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...

CVE-2025-26350

CVE-2025-26350 corresponds to a CWE-434 vulnerability in Q-Free MaxTime up to version 2.11.0, where the template file uploads allow an authenticated remote attacker to upload malicious files via crafted HTTP requests. The root cause is an unrestricted upload of files with dangerous types in the t...

CVE-2025-26349

A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests...