CVE-2025-59384

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: Qfiling 3.13.1 and later

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-593859.8An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers CVE-2025-593864.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an a CVE-2025-593878.1An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit CVE-2025-593889.8A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulne CVE-2025-593899.8An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to CVE-2025-59394.4The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includin CVE-2025-593909.8Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configu CVE-2025-593916.5A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds CVE-2025-593926.8On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (co CVE-2025-593975.0Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.CVE-2025-593983.1The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, becau CVE-2025-593993.1libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation.