CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability

Vulnerability summary

CVE-2025-0111 is a high (CVSS 7.1) External Control of File Name or Path vulnerability in Palo Alto Networks PAN-OS. It is known to be exploited: CISA lists it, first on 20-02-2025. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.5% of scored vulnerabilities.

Timeline

1. 12-02-2025
   PublishedVulnerability first disclosed.
2. 20-02-2025
   Added to CISA KEVPalo Alto Networks PAN-OS File Read Vulnerability
3. 13-03-2025
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 26-02-2026
   Last modifiedVulnerability information updated.

Description

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.