CVE-2025-53120

Securden Unified PAM Path Traversal In File Upload

Exploitation likely. EPSS gives it a 11% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.19.4Critical EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2025-08-25Updated 2025-08-25Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Securden Unified PAMAffected: ≥ 9.0.*, ≤ 11.3.1Upgrade to: after 11.3.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization runs Securden Unified PAM and whether it is reachable from the internet.
Contact Securden support directly to ask for a fix or mitigation, since no official patch version has been published yet.
If internet-facing, temporarily restrict access to the upload functionality or place the system behind a firewall/VPN until a fix is confirmed.
Review server logs and configuration/web root directories for unexpected files as a precaution.
Once Securden releases a fixed version, upgrade immediately and verify the upload endpoint no longer accepts path traversal input.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server.

In plain language

Written by AI from the record

Securden Unified PAM, a tool businesses use to manage passwords and privileged access, has a serious flaw that could let an outsider take over the server without even logging in — this needs attention, though there's no sign yet of attackers using it in the wild.

Unauthenticated path traversal in Securden Unified PAM's file upload functionality allows an attacker to write malicious scripts/binaries into web root and configuration directories, achieving remote code execution with no authentication or user interaction required.

If you're affected

Full server takeover
Exposure of stored privileged credentials
Ransomware risk
Operational disruption

What is it

Think of this software like a digital vault that stores passwords and access keys for your most sensitive systems. This flaw is like a broken side door into that vault's server — someone outside doesn't need a key or password, they can slip in a harmful file and effectively seize control of the vault itself, including everything it protects.

Who is affected

This matters to you if your business uses Securden Unified PAM to manage passwords, credentials, or privileged access to your systems. It is a risk primarily if the Unified PAM server is reachable from the internet, since the flawed upload feature can be triggered remotely by anyone, without a login.

How urgent is it

There is no confirmed evidence yet of attackers actively exploiting this flaw, and it is not on any government list of known exploited vulnerabilities, but the ease of attack (no login needed) and the severity (full server takeover) mean it should be treated as a priority to investigate and address soon — not an emergency drop-everything situation, but not something to leave unaddressed either.

What to do — in detail

Identify all instances of Securden Unified PAM in your environment and determine internet exposure of the upload endpoint. 2. No fixed version has been published by the vendor as of this writing — contact Securden support directly for a hotfix, mitigation guidance, or disclosure timeline. 3. As an interim mitigation, restrict network access to the Unified PAM service (firewall rules, VPN-only access, or IP allowlisting) and disable or restrict the unauthenticated upload functionality if configurable. 4. Audit web root and configuration directories for unexpected or recently modified files (scripts, binaries) as indicators of compromise. 5. Once a patch is released, apply it immediately and re-test the upload endpoint for path traversal (e.g., '../' sequences) to confirm remediation. 6. Monitor EPSS trend (currently rising) and vendor advisories/news for signs of active exploitation, which would elevate urgency.

Technical context

CVSS 9.4 (Critical) reflects network-exploitable, unauthenticated, no-user-interaction access with high confidentiality/integrity impact and limited availability impact. Weakness is CWE-22 (Path Traversal) in an unauthenticated file upload handler, enabling arbitrary file write to web root/config directories and subsequent remote code execution. No public exploit code is currently on record and the CVE is not listed in CISA KEV, indicating exploitation is not yet confirmed in the wild. EPSS places this in the 96th percentile with a rising trend, signaling elevated predicted likelihood of future exploitation attempts despite the absence of current confirmation. No vendor patch information is available at this time.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 404 days, from the signal feeds we watch.

2026-10-03EPSS band changelow → moderateepss band change
2026-06-25OpenVAS check added
2025-08-25Publishedweakness classified, att&ck mapped, record updated

Affected products

Securdencommercialaka secureden
- Unified PAMOn-premSecurity Products / identity-access-mgmt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Scored 9.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability LowReduced performance or intermittent disruption of service