Path Traversal vulnerability in PNETLab
PNETLab v4.2.10.
INCIBE has coordinated the publication of a high severity vulnerability affecting PNETLab version 4.2.10, a tool to create, share and practice Networking Lab with multi-vendors.This vulnerability has been discovered by Reza Rashidi from Hazard Lab.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2025-40629: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N| CWE-22
There is no reported solution at this time.
CVE-2025-40629: the application PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory.
