WaveStore Server path traversal enables root command execution
Three path traversal vulnerabilities in WaveStore Server allow high-privilege attackers to execute arbitrary OS commands and read/delete files, including as root.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of three path traversal vulnerabilities in WaveStore Server software that allow authenticated attackers with high privileges to escalate their capabilities beyond intended restrictions. CVE-2025-65074 permits arbitrary OS command execution via the showerr script. CVE-2025-65075 enables file read/delete operations with dvr user permissions through the alog script. CVE-2025-65076 is the most severe, allowing any file on the server to be read or deleted via the ilog script running with root privileges.
The vulnerabilities exist in the interface between WaveView client and WaveStore Server, where clients can execute a restricted set of predefined commands and scripts. Path traversal weaknesses in three scripts (showerr, alog, ilog) bypass these restrictions. While exploitation requires existing high-privilege access, the ability to escalate to root-level file operations and arbitrary command execution represents a significant security risk. All issues were addressed in WaveStore Server version 6.44.44.
Mentioned in this report
Detection guidance
WaveStore Server Script Invocation With Path Traversal Sequence
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command-line arguments to WaveStore Server's showerr, alog, or ilog scripts that contain directory traversal sequences, indicating attempted path traversal to access files outside the restricted script scope. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WaveStore Server Script Path Traversal Attempt
logsource:
category: process_creation
product: linux
detection:
selection_script:
CommandLine|contains:
- showerr
- alog
- ilog
selection_traversal:
CommandLine|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
condition: selection_script and selection_traversal
falsepositives:
- Legitimate diagnostic script invocations that happen to reference relative paths
for log rotation
level: high
tags:
- attack.t1083
- attack.t1068
id: 33661fea-4469-595c-90a2-6b7085caa604
status: experimental
author: Vorant
Shell Process Spawned by WaveStore Server Script Handler
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or command interpreter being spawned as a child of the WaveStore Server process, consistent with exploitation of CVE-2025-65074 (arbitrary OS command execution via the showerr script). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process From WaveStore Server
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- wavestore
- WaveStore
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
condition: selection_parent and selection_child
falsepositives:
- Legitimate maintenance scripts or health-check cron jobs invoked by the WaveStore
service itself
falsepositives2: none
level: high
tags:
- attack.t1106
- attack.t1068
id: 32fbaa07-3866-5e7e-a06f-c8f4a4d13ac3
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65074
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs