CVE-2025-14728: Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue…
CVE-2025-14728 · Severity: medium · CVSS 6.8 · Published 2025-12-29
Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E".
Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.
No. Junglewise Threat Intelligence has no report of CVE-2025-14728 being exploited in the wild.
How severe is CVE-2025-14728?
Medium severity, with a CVSS score of 6.8, published 29 December 2025.
Which products and versions are affected?
Linux Kernel, Rapid7 Velociraptor. The advisory does not name versions.
Is there a fix for CVE-2025-14728?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-14728?
Check whether you run Linux Kernel or Rapid7 Velociraptor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.