ZDI-25-1052: Ivanti Endpoint Manager CAB File Parsing Directory Traversal Remote Code Execution Vulnerability
Published Dec 10, 2025
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2025-13661.
Affected Software
1 affected component
Ivanti Endpoint Manager
Event History
Dec 10, 2025
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-25-1052?
The vulnerability ZDI-25-1052 has a CVSS rating of 7.1, indicating its high severity.
2
How do I fix ZDI-25-1052?
To remediate ZDI-25-1052, apply the appropriate security patches provided by Ivanti for Endpoint Manager.
3
What type of attackers can exploit ZDI-25-1052?
ZDI-25-1052 can be exploited by remote attackers, but requires authentication.
4
What software is affected by ZDI-25-1052?
The vulnerability ZDI-25-1052 affects Ivanti Endpoint Manager installations.
5
What potential impact can ZDI-25-1052 have on systems?
Exploitation of ZDI-25-1052 allows remote attackers to execute arbitrary code on affected systems.