CVE-2026-25760
📋 TL;DR
CVE-2026-25760 is an authenticated path traversal vulnerability in Sliver's website content subsystem that allows authenticated operators to read arbitrary files on the server host. This can expose sensitive credentials, configuration files, and cryptographic keys. Only Sliver servers running versions prior to 1.6.11 with authenticated operators are affected.
💻 Affected Systems
- Sliver C2 Framework
📦 What is this software?
Sliver by Bishopfox
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Sliver C2 server including theft of all credentials, configuration secrets, and cryptographic keys, potentially enabling attacker persistence and lateral movement.
Likely Case
Exfiltration of sensitive configuration files, credentials, and keys that could compromise the C2 infrastructure and connected implants.
If Mitigated
Limited impact if proper access controls and file system permissions restrict operator access to sensitive directories.
🎯 Exploit Status
Exploitation requires authenticated operator access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.11
Vendor Advisory: https://github.com/BishopFox/sliver/security/advisories/GHSA-2286-hxv5-cmp2
Restart Required: Yes
Instructions:
1. Stop all Sliver server instances. 2. Update Sliver to version 1.6.11 or later using your package manager or from GitHub releases. 3. Restart Sliver server instances.
🔧 Temporary Workarounds
Restrict Operator Access
allTemporarily remove or disable operator accounts until patching can be completed.
# Review and modify operator configurations in Sliver config files
File System Permissions Hardening
linuxApply strict file system permissions to sensitive directories containing credentials and configuration files.
chmod 600 /path/to/sensitive/files
chown root:root /path/to/sensitive/files
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Sliver servers from sensitive infrastructure
- Deploy file integrity monitoring on Sliver server hosts to detect unauthorized file access
🔍 How to Verify
Check if Vulnerable:
Check Sliver server version; if version is less than 1.6.11, the system is vulnerable.Check Version:
sliver-server --versionVerify Fix Applied:
Confirm Sliver server version is 1.6.11 or later and test that authenticated operators cannot access files outside intended directories.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from operator accounts
- Access to sensitive system files from Sliver process
Network Indicators:
- Unusual data exfiltration from Sliver server to operator-controlled endpoints
SIEM Query:
source="sliver.log" AND (event="file_access" OR event="path_traversal")