What’s Vulnerable › Vulnerabilities

CVE-2025-34047: Leadsec VPN Path Traversal Arbitrary File Read

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-26 · updated 2026-06-17
• Weakness: CWE-20

Description

A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences to escape the intended directory and access sensitive files. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Affected products

• Beijing NetGuard Nebula Information Technology Co., Ltd. Leadsec SSL VPN: 0

References

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml
• https://vulncheck.com/advisories/leadsec-vpn-path-traversal-file-read
• https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035
• https://www.leadsec.com.cn/
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml

Get alerted when CVE-2025-34047 or the next vulnerability affects your stack