CVE-2025-0124 — External Control of File Name or Path in Palo Alto Networks Pan-os

CWE-73 — External Control of File Name or Path4 documents4 sources
Severity
5.1MEDIUMNVD
EPSS
0.7%
top 28.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPalo Alto Networks Cloud Ngfw+3 more
Timeline
PublishedApr 11

Description

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to o…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages6 packages

▶NVDpaloaltonetworks/pan-os10.1.0 — 10.1.14+5
▶CVEListV5palo_alto_networks/pan-os11.2.0 — 11.2.1+4

🔴Vulnerability Details

2
GHSA
GHSA-56hj-453m-vxfv: An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the m↗2025-04-11
▶
CVEList
PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface↗2025-04-11
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface↗
▶
CVE-2025-0124 — External Control of File Name or Path | cvebase