Remote Code Execution in MarkAny SafePC Enterprise

The impact of CVE-2025-11020 is significant due to the potential for Remote Code Execution. An attacker exploiting this vulnerability could gain unauthorized access to the system, execute arbitrary commands, and potentially escalate privileges. The combination of Path Traversal and SQL Injection allows for a multi-stage attack, where an attacker first obtains server information via Path Traversal, then uses SQL Injection to manipulate data and ultimately upload malicious files. Successful exploitation could lead to data breaches, system takeover, and disruption of services. The unrestricted file upload component amplifies the risk, as attackers could upload web shells or other malicious payloads to gain persistent access.

Organizations utilizing SafePC Enterprise, particularly those with older versions (7.0.0.0) and those with lax file upload policies or inadequate input validation, are at significant risk. Shared hosting environments where multiple users share the same SafePC Enterprise instance are also particularly vulnerable, as a compromise of one user's account could lead to broader system compromise.

• windows / supply-chain:

Get-Process -Name SafePCEnterprise | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*SafePCEnterprise*'}

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath '//Event[System[Provider[@Name='SafePCEnterprise']]]'

• linux / server:

journalctl -u SafePCEnterprise | grep -i "path traversal"

• linux / server:

lsof -i :8080 | grep SafePCEnterprise

1. 2025-10-02Disclosure

   disclosure

2. 2025-10-02Patch

   patch

1. Reserviert2025-09-26
2. Veröffentlicht2025-10-02
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-11020 is to upgrade SafePC Enterprise to version 7.0.1 or later. If upgrading immediately is not possible, consider implementing temporary workarounds. Restrict file upload locations and types to prevent the upload of dangerous files. Implement strict input validation and sanitization to prevent SQL Injection attacks. Consider using a Web Application Firewall (WAF) to filter malicious traffic and block attempts to exploit the Path Traversal vulnerability. After upgrading, confirm the fix by attempting to trigger the Path Traversal and SQL Injection vulnerabilities and verifying that they are no longer exploitable.