CVE-2025-26355
📋 TL;DR
This path traversal vulnerability in Q-Free MaxTime allows authenticated remote attackers to delete sensitive files via crafted HTTP requests. It affects Q-Free MaxTime versions up to and including 2.11.0. Organizations using vulnerable versions of this traffic management software are at risk.
💻 Affected Systems
- Q-Free MaxTime
📦 What is this software?
Maxtime by Q Free
⚠️ Risk & Real-World Impact
Worst Case
Critical system files could be deleted, causing service disruption, data loss, or system compromise leading to complete system unavailability.
Likely Case
Attackers delete configuration files, logs, or application data, disrupting traffic management operations and requiring restoration from backups.
If Mitigated
With proper network segmentation and file permission controls, impact is limited to non-critical files within the application's context.
🎯 Exploit Status
Exploitation requires valid authentication credentials but uses simple path traversal techniques once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version > 2.11.0
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26355
Restart Required: Yes
Instructions:
1. Contact Q-Free for patched version >2.11.0
2. Backup current configuration and data
3. Install updated version
4. Restart MaxTime services
5. Verify functionality
🔧 Temporary Workarounds
Restrict API Access
linuxLimit network access to the MaxTime API endpoint to trusted IP addresses only
iptables -A INPUT -p tcp --dport [API_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [API_PORT] -j DROP
File Permission Hardening
linuxSet restrictive permissions on sensitive directories to prevent deletion
chmod 755 /var/lib/maxtime/
chmod 644 /var/lib/maxtime/*
chown root:root /var/lib/maxtime/
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MaxTime systems from untrusted networks
- Enforce least privilege access controls and regularly rotate authentication credentials
🔍 How to Verify
Check if Vulnerable:
Check MaxTime version via web interface or configuration files; if version ≤2.11.0, system is vulnerableCheck Version:
grep -i version /opt/maxtime/config/*.conf 2>/dev/null || cat /var/lib/maxtime/version.txt 2>/dev/nullVerify Fix Applied:
Confirm version >2.11.0 is installed and test API endpoint with path traversal attempts returns proper error responses📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /maxtime/api/database/database.lua with ../ patterns
- File deletion events in system logs from maxtime process
Network Indicators:
- Unusual patterns of HTTP requests to the database.lua endpoint
- Multiple failed file access attempts from single source
SIEM Query:
source="maxtime.log" AND (uri="/maxtime/api/database/database.lua" AND (message="../" OR message="..\\"))