CVE-2025-66480: Directory Traversal in Wildfire IM Server

The directory traversal vulnerability in Wildfire IM Server allows an attacker to bypass intended file access restrictions. By crafting malicious filenames containing directory traversal sequences (e.g., ../), an attacker can manipulate the upload process to read files outside of the intended upload directory. This could lead to the exposure of sensitive configuration files, source code, or even system files. The potential impact is severe, as an attacker could gain a deeper understanding of the server's infrastructure and potentially escalate their access. Successful exploitation could mirror the impact of similar directory traversal vulnerabilities observed in other applications, where attackers have gained unauthorized access to critical system resources.

1. Reserved2025-12-02
2. Published2026-02-02
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66480 is to immediately upgrade Wildfire IM Server to version 1.4.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file upload access to trusted users only, implementing strict filename validation on the server-side to strip out directory traversal sequences, and configuring a Web Application Firewall (WAF) to block requests containing suspicious filenames. Regularly monitor file system access logs for unusual activity. After upgrading, verify the fix by attempting a file upload with a malicious filename containing directory traversal sequences (e.g., ../../../../etc/passwd) to ensure the upload is rejected.