{"id":"CVE-2025-2264","aliases":["EUVD-2025-6301","GHSA-xrc3-9jj6-mqcm"],"status":"published","title":"Santesoft Sante PACS Server Path Traversal Information Disclosure","description":"A Path Traversal Information Disclosure vulnerability exists in \"Sante PACS Server.exe\". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.35383,"percentile":0.98459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-03-13T16:29:07Z","modified":"2026-06-17T09:06:39Z","exploits":[{"source":"metasploit","id":"auxiliary/gather/pacsserver_traversal","title":"Sante PACS Server Path Traversal (CVE-2025-2264)","type":"auxiliary","date":"2025-03-13","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/pacsserver_traversal"},{"source":"nuclei","id":"CVE-2025-2264","title":"Sante PACS Server.exe - Path Traversal Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2264.yaml"}],"products":[{"vendor":"santesoft","product":"sante pacs server"},{"vendor":"santesoft","product":"sante_pacs_server"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2025-08","tags":["exploit","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2264"},{"url":"https://github.com/advisories/GHSA-xrc3-9jj6-mqcm"}],"sources":{"cve":[{"id":"CVE-2025-2264","title":"Santesoft Sante PACS Server Path Traversal Information Disclosure","description":"A Path Traversal Information Disclosure vulnerability exists in \"Sante PACS Server.exe\". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.","status":"published","published":"2025-03-13T16:29:07.468Z","modified":"2025-03-14T13:41:13.356Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-6301","description":"A Path Traversal Information Disclosure vulnerability exists in \"Sante PACS Server.exe\". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.","status":"published","published":"2025-03-13T16:29:07Z","modified":"2025-03-14T13:41:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:03.250545Z"}],"ghsa":[{"id":"GHSA-xrc3-9jj6-mqcm","title":"A Path Traversal Information Disclosure vulnerability exists in \"Sante PACS Server.exe\". An...","description":"A Path Traversal Information Disclosure vulnerability exists in \"Sante PACS Server.exe\". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.","status":"published","published":"2025-03-13T18:32:23Z","modified":"2025-03-13T18:32:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:00:16.082166Z"}],"nvd":[{"id":"CVE-2025-2264","description":"A Path Traversal Information Disclosure vulnerability exists in \"Sante PACS Server.exe\". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.","status":"published","published":"2025-03-13T17:15:38.787Z","modified":"2026-06-17T09:06:39.287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:53.93104Z"}]}}