Linknat VOS Manager Path Traversal File Disclosure
Vulnerability Description
A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/', '/chs/', or '/cht/', where the 'js/lang_en_us.js' or equivalent files are loaded. By injecting encoded traversal sequences such as '%c0%ae%c0%ae' into the request path, attackers can bypass input validation and disclose sensitive files.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34118
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- zqsky of WooYun
References
- http://www.linknat.com/
- https://web.archive.org/web/20151013001957/http://www.wooyun.org/bugs/wooyun-2010-0145458
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linknat_vos_traversal.rb
- https://www.vulncheck.com/advisories/linknat-vos-manager-path-traversal-file-disclosure
Affected Vendor
Linknat Technology
View all reports →