CVE-2025-14728: Rapid7 Velociraptor Directory Traversal Vulnerability

Vulnerability summary

CVE-2025-14728 is a medium (CVSS 6.8) Path Traversal vulnerability in rapid7 velociraptor. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-12-2025
   PublishedVulnerability first disclosed.
2. 30-12-2025
   Last modifiedVulnerability information updated.

Description

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E". Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.