CVE-2025-26352
📋 TL;DR
This path traversal vulnerability in Q-Free MaxTime allows authenticated remote attackers to delete sensitive files by manipulating HTTP requests. It affects all installations running version 2.11.0 or earlier. Attackers need valid credentials but can potentially delete critical system files.
💻 Affected Systems
- Q-Free MaxTime
📦 What is this software?
Maxtime by Q Free
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, configuration files, or application binaries leading to service disruption or system crash.
Likely Case
Deletion of application configuration files, logs, or user data causing service disruption, data loss, and potential downtime.
If Mitigated
Limited impact to non-critical files if proper file permissions and access controls are implemented.
🎯 Exploit Status
Requires authenticated access but exploitation is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 2.11.0
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26352
Restart Required: Yes
Instructions:
1. Contact Q-Free for updated version >2.11.0. 2. Backup configuration and data. 3. Install the updated version. 4. Restart the MaxTime service. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict File Permissions
linuxSet strict file permissions on sensitive directories to prevent deletion
chmod 750 /path/to/sensitive/directories
chown root:root /path/to/sensitive/directories
Network Segmentation
allRestrict access to MaxTime administration interface to trusted networks only
🧯 If You Can't Patch
- Implement strict access controls and multi-factor authentication for all MaxTime users
- Deploy file integrity monitoring to detect unauthorized file deletions
🔍 How to Verify
Check if Vulnerable:
Check MaxTime version in administration interface or configuration files. If version is 2.11.0 or earlier, system is vulnerable.Check Version:
Check web interface or configuration files for version informationVerify Fix Applied:
Verify version is >2.11.0 and test template deletion functionality with path traversal attempts.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with unusual file paths in template deletion endpoints
- Multiple failed file deletion attempts
- Successful deletion of files outside expected directories
Network Indicators:
- HTTP POST requests to template deletion endpoints with path traversal sequences (../, ..\)
- Unusual patterns of file deletion requests
SIEM Query:
source="maxtime" AND (uri="*delete*" OR uri="*template*") AND (uri="*../*" OR uri="*..\*")