CVE-2025-53880: susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal
A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53880?
CVE-2025-53880 is considered a high severity vulnerability due to its potential for unauthorized file manipulation.
How do I fix CVE-2025-53880?
To fix CVE-2025-53880, it is recommended to apply security patches provided by SUSE for the SUSE Manager TFTPSync product.
Who is affected by CVE-2025-53880?
CVE-2025-53880 affects users of SUSE Manager TFTPSync that are exposed to adjacent network threats.
What type of vulnerability is CVE-2025-53880?
CVE-2025-53880 is a Path Traversal vulnerability that allows improper file access.
Is authentication required to exploit CVE-2025-53880?
No, CVE-2025-53880 is unauthenticated, meaning attackers can exploit it without prior authentication.