Q-Free MaxTime Traffic Light Path Traversal

The vulnerability of the Q-Free MaxTime traffic light management software is related to an incorrect restriction on the path name for the maxtime/api/database/database. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a...

CVE-2025-26354: Path Traversal: '.../...//'

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26357: Path Traversal: '.../...//'

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...

CVE-2025-26353: Path Traversal: '.../...//'

A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...

PT-2025-7142

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: A Path Traversal issue in maxtime/api/sql/sql.lua allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. Recommendations: For versions prior to 2.11.0,...

CVE-2025-26355: Path Traversal: '.../...//'

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

PT-2025-7144

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: A Path Traversal issue in the maxtime/api/database/database.lua file allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests. Recommendations: For versio...

PT-2025-7145

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: A path traversal issue in the setActive endpoint of maxtime/api/database/database.lua allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests. The...