CRITICALCVSS 9.1

CVE-2025-40549

CVE-2025-40549 updated by NVD

Modified: 2026-10-20
Sources: nvd

Summary

A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-40549

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.