CVE-2025-14728

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to...

CVE-2025-14728

CVE-2025-14728 affects Rapid7 Velociraptor prior to 0.75.6. A directory traversal vulnerability arises on Linux where a rogue client can upload a file written outside the datastore directory due to insufficient sanitization of directory names that end with a dot, encoded as %2E. Although files ma...