CVE-2025-26357
📋 TL;DR
This vulnerability allows authenticated remote attackers to read sensitive files on Q-Free MaxTime systems via path traversal attacks. Attackers can access files outside the intended directory by crafting malicious HTTP requests. Organizations using Q-Free MaxTime version 2.11.0 or earlier are affected.
💻 Affected Systems
- Q-Free MaxTime
📦 What is this software?
Maxtime by Q Free
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading of configuration files, credentials, or sensitive system files leading to further attacks.
Likely Case
Unauthorized access to sensitive configuration files, database credentials, or system information that could enable lateral movement.
If Mitigated
Limited impact if proper authentication controls and file system permissions restrict access to critical files.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the vulnerable endpoint. Path traversal attacks are generally straightforward to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version > 2.11.0
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26357
Restart Required: Yes
Instructions:
1. Contact Q-Free for updated version > 2.11.0. 2. Backup current configuration. 3. Install the patched version. 4. Restart MaxTime services. 5. Verify the fix.
🔧 Temporary Workarounds
Restrict API Access
linuxImplement network segmentation or firewall rules to restrict access to the vulnerable API endpoint
iptables -A INPUT -p tcp --dport [MaxTime_PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [MaxTime_PORT] -j DROP
File System Permissions
linuxRestrict file system permissions for the MaxTime service account to limit accessible directories
chmod 750 /path/to/maxtime
chown -R maxtime:maxtime /path/to/maxtime
🧯 If You Can't Patch
- Implement strict authentication controls and monitor for suspicious API access patterns
- Deploy web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check MaxTime version and test authenticated API requests with path traversal payloads to /maxtime/api/database/database.luaCheck Version:
Check MaxTime web interface or configuration files for version informationVerify Fix Applied:
Test with same path traversal payloads after patching - should return error or no file access📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in MaxTime logs
- HTTP requests containing '../' or similar path traversal sequences to /maxtime/api/database/database.lua
Network Indicators:
- HTTP requests with path traversal payloads to MaxTime API endpoint
- Unusual file read patterns from MaxTime server
SIEM Query:
source="maxtime.log" AND ("../" OR "..\" OR "%2e%2e%2f") AND uri_path="/maxtime/api/database/database.lua"