CVE-2025-54769

KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

Affected

Xorux · LPAR2RRD

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

3.40% chance of exploitation in the next 30 days, 89th percentile

Published

2025-07-28

Updated

2025-11-03

Proof-of-concept exploits (3)

• https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt
• byteReaper77/CVE-2025-547692★ · 2025-07-30
• tunahantekeoglu/CVE-2025-547690★ · 2026-10-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52391

Security advisories

• https://lpar2rrd.com/note800.php

References

• CVE Record
• NVD entry

Related

• CVE-2022-0847
• CVE-2024-4577
• CVE-2025-10046
• CVE-2025-11077
• CVE-2025-2783
• CVE-2025-32429