CVE-2025-66608: yokogawa electric corporation fast/tools Path Traversal: '\..\filename'

Vulnerability summary

CVE-2025-66608 is a high (CVSS 8.7) Path Traversal: '\..\filename' vulnerability in yokogawa electric corporation fast/tools. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.8% of scored vulnerabilities.

Timeline

1. 09-02-2026
   PublishedVulnerability first disclosed.
2. 09-02-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04

• CWE-29Path Traversal: '\..\filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.