CVE-2025-53880: susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-35

Description

A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.

Affected products

SUSE Container suse/manager/4.3/proxy-httpd:latest: from ? before 4.3.11-150400.3.15.3 — fixed in 4.3.11-150400.3.15.3
SUSE Container suse/manager/5.0/x86_64/proxy-httpd:latest: from ? before 5.0.3-150600.3.6.4 — fixed in 5.0.3-150600.3.6.4
SUSE Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:latest: from ? before 5.1.3-150700.3.3.3 — fixed in 5.1.3-150700.3.3.3
SUSE Manager Proxy LTS 4.3: from ? before 4.3.11-150400.3.15.3 — fixed in 4.3.11-150400.3.15.3

How to fix

Upgrade to a fixed version: SUSE Container suse/manager/4.3/proxy-httpd:latest 4.3.11-150400.3.15.3; SUSE Container suse/manager/5.0/x86_64/proxy-httpd:latest 5.0.3-150600.3.6.4; SUSE Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:latest 5.1.3-150700.3.3.3; SUSE Manager Proxy LTS 4.3 4.3.11-150400.3.15.3. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53880

Get alerted when CVE-2025-53880 or the next vulnerability affects your stack