# CVE-2025-10468: Beyaz Computer CityPlus path traversal

Source: https://junglewise.ai/threats/cve-2025-10468-beyaz-computer-cityplus-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-19. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-10468 · Severity: high · CVSS 7.5 · Published 2025-09-19

Beyaz Computer CityPlus is a software solution used for municipal or urban management. A security vulnerability allows unauthorized individuals to bypass directory restrictions and access sensitive files on the server. This could lead to the exposure of confidential administrative data or system configuration files, potentially compromising the privacy of the organization's operations.

## Quick answers

**Is CVE-2025-10468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-10468 being exploited in the wild.

**How severe is CVE-2025-10468?** High severity, with a CVSS score of 7.5, published 19 September 2025.

**Which products and versions are affected?** Beyaz Computer CityPlus before 24.29375.

**Is there a fix for CVE-2025-10468?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-10468 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-10468?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Path Traversal vulnerability (CWE-22) exists in Beyaz Computer CityPlus versions prior to 24.29375. The flaw stems from insufficient validation of user-supplied input used to construct file paths, allowing an attacker to use special sequences like '../' to escape the intended directory. This is a network-based attack that requires no authentication or user interaction. Successful exploitation allows a remote attacker to read arbitrary files on the filesystem, potentially leading to the disclosure of sensitive information. Users are advised to upgrade to version 24.29375 or later to mitigate this risk.

## Affected products

- Beyaz Computer CityPlus before 24.29375

## Timeline

- 2025-09-19: advisory: Initial publication of CVE-2025-10468

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0279](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0279)
- [https://www.usom.gov.tr/bildirim/tr-25-0279](https://www.usom.gov.tr/bildirim/tr-25-0279)