CVE-2025-27022: Path Traversal Vulnerability in Infinera G42

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-02 · updated 2026-06-17
Weakness: CWE-22

Description

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.

Affected products

Infinera G42: from 6.1.3 before 7.1 — fixed in 7.1

How to fix

Upgrade to a fixed version: Infinera G42 7.1. Check the vendor advisory for mitigations.

References

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27022
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27022

Get alerted when CVE-2025-27022 or the next vulnerability affects your stack