CVE-2025-34517

HighCVSS 7.5/10Last modified Oct 9, 2026

Description

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Ilevia Srl.	EVE X1 Server	<= 4.7.18.0.eden

References

https://www.ilevia.com/Product
https://www.vulncheck.com/advisories/ilevia-eve-x1-server-absolute-path-traversalThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5960.phpExploit, Third Party Advisory

Timeline

Published: Oct 16, 2025
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-345187.5Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows a CVE-2025-345197.5Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product stores passwords usi CVE-2025-34524.3The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability CVE-2025-345209.8An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized acces CVE-2025-345215.4A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsani CVE-2025-345229.8A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be tri CVE-2025-345239.8A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). T CVE-2025-34535.3The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Categor CVE-2025-34545.0This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the UR CVE-2025-34558.8The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of dat CVE-2025-34563.8On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote acc CVE-2025-34575.4The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions