Absolute Path Traversal Vulnerability in Ilevia EVE X1 Server Firmware
CVE-2025-34517

8.7HIGH

Key Information:

Vendor

Ilevia Srl.

Status
Eve X1 Server
Vendor
CVE Published:
16 October 2025

Badges

👾 Exploit Exists

What is CVE-2025-34517?

The Ilevia EVE X1 Server firmware versions up to 4.7.18.0.eden are susceptible to an absolute path traversal vulnerability located in the get_file_content.php script. This security flaw permits an unauthorized user to read arbitrary files from the server's file system. Ilevia has advised users to take preventive measures, including avoiding exposure of port 8080 to the internet, as this could further mitigate potential exploitation of the vulnerability.

Affected Version(s)

EVE X1 Server * <= 4.7.18.0.eden

References

https://www.ilevia.com/
product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-59...
technical-descriptionexploit
https://www.vulncheck.com/advisories/ilevia-eve-x1-server...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2025-34517 : Absolute Path Traversal Vulnerability in Ilevia EVE X1 Server Firmware