CVE-2019-25256: VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-24 · updated 2026-06-17
Weakness: CWE-22

Description

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files through unvalidated 'ID' parameters. Attackers can exploit multiple Perl scripts like downloadsys.pl to read sensitive files by manipulating directory path traversal in download requests.

Affected products

VideoFlow Ltd. Digital Video Protection DVP: 2.10, 1.40.0.15, 2.10.0.5

References

http://www.video-flow.com
https://www.exploit-db.com/exploits/44386
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php
http://www.video-flow.com
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php

Get alerted when CVE-2019-25256 or the next vulnerability affects your stack