Medium severity · published Nov 30, 2025
CVE-2025-13791
Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Scada-LTS · Scada-lts
2.7.8.0; 2.7.8.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13791
Exploit
https://github.com/Xzzz111/exps/blob/main/archives/Scada-LTS-ZipSlip-1/report.md
Exploit
https://github.com/Xzzz111/exps/blob/main/archives/Scada-LTS-ZipSlip-1/report.md#proof-of-concept
Permissions Required
https://vuldb.com/?ctiid.333795
Third Party Advisory
https://vuldb.com/?id.333795
Third Party Advisory
https://vuldb.com/?submit.690873
More from Scada-LTS
9.9
CVE-2026-19656
ScadaLTS Authenticated Remote Code Execution
8.8
CVE-2026-84860
Scada-LTS DWR Authorization Bypass - Systemic
8.8
CVE-2026-84858
Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass
8.8
CVE-2025-13790
Scada-LTS cross-site request forgery
8.8
CVE-2023-33472
An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code,…