6.5 CVE-2025-0111

CISA Kev Catalog Path Traversal

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
https://nvd.nist.gov/vuln/detail/CVE-2025-0111

References

psirt@paloaltonetworks.com

https://security.paloaltonetworks.com/CVE-2025-0111 Vendor Advisory

CPE

cpe	start	end
Configuration 1
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 10.1.0	< 10.1.14
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 10.2.0	< 10.2.7
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 10.2.10	< 10.2.12
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 11.0.0	< 11.1.6
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 11.2.0	< 11.2.4
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h4::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2::::::

REMEDIATION

EXPLOITS

Exploit-db.com

id	description	date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id	description	severity
13	Subverting Environment Variable Values The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary. [Probe target application] The adversary first probes the target application to determine important information about the target. This information could include types software used, software versions, what user input the application consumes, and so on. Most importantly, the adversary tries to determine what environment variables might be used by the underlying software, or even the application itself. [Find user-controlled environment variables] Using the information found by probing the application, the adversary attempts to manipulate any user-controlled environment variables they have found are being used by the application, or suspect are being used by the application, and observe the effects of these changes. If the adversary notices any significant changes to the application, they will know that a certain environment variable is important to the application behavior and indicates a possible attack vector. [Manipulate user-controlled environment variables] The adversary manipulates the found environment variable(s) to abuse the normal flow of processes or to gain access to privileged resources.	Very High
267	Leverage Alternate Encoding An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various payloads using a variety of different types of encodings to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited.	High
64	Using Slashes and URL Encoding Combined to Bypass Validation Logic This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc. The attacker accesses the server using a specific URL. The attacker tries to encode some special characters in the URL. The attacker find out that some characters are not filtered properly. The attacker crafts a malicious URL string request and sends it to the server. The server decodes and interprets the URL string. Unfortunately since the input filtering is not done properly, the special characters have harmful consequences.	High
72	URL Encoding This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. [Survey web application for URLs with parameters] Using a browser, an automated tool or by inspecting the application, an adversary records all URLs that contain parameters. [Probe URLs to locate vulnerabilities] The adversary uses the URLs gathered in the "Explore" phase as a target list and tests parameters with different encodings of special characters to see how the web application will handle them. [Inject special characters into URL parameters] Using the information gathered in the "Experiment" phase, the adversary injects special characters into the URL using URL encoding. This can lead to path traversal, cross-site scripting, SQL injection, etc.	High
76	Manipulating Web Input to File System Calls An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible. [Fingerprinting of the operating system] In order to create a valid file injection, the attacker needs to know what the underlying OS is so that the proper file seperator is used. [Survey the Application to Identify User-controllable Inputs] The attacker surveys the target application to identify all user-controllable inputs, possibly as a valid and authenticated user [Vary inputs, looking for malicious results] Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of the targeted file or other file system control syntax to be passed to the application [Manipulate files accessible by the application] The attacker may steal information or directly manipulate files (delete, copy, flush, etc.)	Very High
78	Using Escaped Slashes in Alternate Encoding This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and attempts to escape multiple different special characters using a backslash. [Manipulate input] Once the adversary determines how to bypass filters that filter out special characters using an escaped slash, they will manipulate the user input in a way that is not intended by the application.	High
79	Using Slashes in Alternate Encoding This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other. [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application. [Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and looks for areas where user input is used to access resources on the target host. The adversary attempts different encodings of slash characters to bypass input filters. [Traverse application directories] Once the adversary determines how to bypass filters that filter out slash characters, they will manipulate the user input to include slashes in order to traverse directories and access resources that are not intended for the user.	High
80	Using UTF-8 Encoding to Bypass Validation Logic This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 specification got some entries wrong (in some cases it permitted overlong characters). UTF-8 encoders are supposed to use the "shortest possible" encoding, but naive decoders may accept encodings that are longer than necessary. According to the RFC 3629, a particularly subtle form of this attack can be carried out against a parser which performs security-critical validity checks against the UTF-8 encoded form of its input, but interprets certain illegal octet sequences as characters. [Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the resources accessed and all other potential entry-points for the web application. [Probe entry points to locate vulnerabilities] The attacker uses the entry points gathered in the "Explore" phase as a target list and injects various UTF-8 encoded payloads to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited.	High
219	XML Routing Detour Attacks An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or re-route the processing of the content. XML Routing Detour Attacks are Adversary in the Middle type attacks (CAPEC-94). The attacker compromises or inserts an intermediate system in the processing of the XML message. For example, WS-Routing can be used to specify a series of nodes or intermediaries through which content is passed. If any of the intermediate nodes in this route are compromised by an attacker they could be used for a routing detour attack. From the compromised system the attacker is able to route the XML process to other nodes of their choice and modify the responses so that the normal chain of processing is unaware of the interception. This system can forward the message to an outside entity and hide the forwarding and processing from the legitimate processing systems by altering the header information. [Survey the target] Using command line or an automated tool, an attacker records all instances of web services to process XML requests. [Identify SOAP messages that have multiple state processing.] Inspect instance to see whether the XML processing has multiple stages or not. [Launch an XML routing detour attack] The attacker injects a bogus routing node (using a WS-Referral service) into the routing table of the XML header of the SOAP message identified in the Explore phase. Thus, the attacker can route the XML message to the attacker controlled node (and access the message contents).	Medium

MITRE

Techniques

id	description
T1027	Obfuscated Files or Information
T1562.003	Impair Defenses:Impair Command History Logging
T1574.006	Hijack Execution Flow:Dynamic Linker Hijacking
T1574.007	Hijack Execution Flow:Path Interception by PATH Environment Variable
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Mitigations

id	description
M1017	Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software.
M1028	Make sure that the <code>HISTCONTROL</code> environment variable is set to “ignoredups” instead of “ignoreboth” or “ignorespace”.
M1028	When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions. Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary.
M1022	Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:Windows</code>, to reduce places where malicious files could be placed for execution. Require that all executables be placed in write-protected directories.
© 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation.

Cybersecurity needs ?

Strengthen software security from the outset with our DevSecOps expertise

Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.

Discover this offer

cpe	start	end
Configuration 1
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 10.1.0	< 10.1.14
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 10.2.0	< 10.2.7
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 10.2.10	< 10.2.12
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 11.0.0	< 11.1.6
cpe:2.3:o:paloaltonetworks:pan-os::::::::	>= 11.2.0	< 11.2.4
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h4::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1::::::
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2::::::