CVE-2025-2264

Santesoft Sante PACS Server Path Traversal Information Disclosure

A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.

Affected

Santesoft · Sante PACS Server

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

35.38% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-22

Published

2025-03-13

Updated

2025-03-14

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2025-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2264.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/pacsserver_traversal.rb

References

• CVE Record
• NVD entry