CVE-2025-8729 Details
Description
A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the file backend/service/upload_service.py. The manipulation of the argument task_id leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is f1b00597e293d09452aabd4fa57f3185207350e8. It is recommended to apply a patch to fix this issue.
A critical directory traversal vulnerability has been identified in MigoXLab LMeterX version 1.2.0. The issue arises in the upload_service.py file, specifically within the process_cert_files function. The vulnerability is caused by improper handling of the task_id parameter, which can be manipulated to escape the intended upload directory. This allows attackers to write files to arbitrary locations on the server. The vulnerability can be exploited remotely, and a public exploit is available.
Users are advised to update to LMeterX version 1.2.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MigoXLab/LMeterX/issues/10 | CISA-ADP | ExploitIssue TrackingPatch |
| https://github.com/MigoXLab/LMeterX/commit/f1b00597e293d09452aabd4fa57f3185207350e8 | [email protected] | Patch |
| https://github.com/MigoXLab/LMeterX/issues/10 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/MigoXLab/LMeterX/issues/10#issue-3255375024 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/MigoXLab/LMeterX/issues/10#issuecomment-3136380379 | [email protected] | ExploitIssue TrackingPatch |
| https://vuldb.com/?ctiid.319225 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.319225 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.621741 | [email protected] | ExploitThird Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| migoxlab lmeterx | 1.2.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Sep 16, 2025 | Initial Analysis | [email protected] |
| Aug 8, 2025 | New CVE Received | [email protected] |
| Aug 8, 2025 | CVE Modified | CISA-ADP |