WaveStore Server path traversal flaws enable RCE
Three path traversal vulnerabilities in WaveStore Server allow high-privilege attackers to execute arbitrary commands, read/delete files, and gain root-level access.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of three path traversal vulnerabilities in WaveStore Server software, affecting the WaveView client's ability to execute predefined commands and scripts. CVE-2025-65074 allows authenticated attackers with high privileges to execute arbitrary OS commands via path traversal in the showerr script. CVE-2025-65075 permits file read and deletion operations with dvr user permissions through the alog script, while CVE-2025-65076 enables arbitrary file read/delete with root privileges via the ilog script.
All three vulnerabilities require the attacker to possess high-level privileges on the WaveView client, but successfully escalate those privileges to execute commands or manipulate files on the connected WaveStore Server. The most critical of the three, CVE-2025-65076, runs with root privileges and represents a complete system compromise if exploited. The vendor has addressed all three issues in WaveStore Server version 6.44.44.
The vulnerabilities were responsibly disclosed by researcher Julia Zduńczyk through CERT Polska's coordinated vulnerability disclosure process. Organizations running WaveStore Server should immediately update to version 6.44.44 or later to remediate these flaws.
Mentioned in this report
Detection guidance
Suspicious Shell Execution via WaveStore Log/Error Script Path Traversal
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell/command execution spawned with references to WaveStore showerr/alog/ilog scripts combined with path traversal sequences, indicating exploitation of CVE-2025-65074/65075/65076. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Execution via WaveStore Log/Error Script Path Traversal
id: a6b8363e-9f3a-513b-b91a-5b78bf5cf167
status: experimental
description: Detects command execution referencing WaveStore's showerr, alog, or ilog
scripts along with path traversal sequences (../ or URL-encoded equivalents), consistent
with exploitation of WaveStore Server path traversal vulnerabilities (CVE-2025-65074/65075/65076)
that allow arbitrary OS command execution.
references:
- CERT Polska coordinated disclosure - WaveStore Server path traversal RCE
logsource:
category: process_creation
product: linux
detection:
selection_script:
CommandLine|contains:
- showerr
- alog
- ilog
selection_traversal:
CommandLine|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- ..\\
condition: selection_script and selection_traversal
falsepositives:
- Legitimate maintenance scripts invoking these log utilities with relative paths
that happen to include '../' for valid parent directory navigation
- Vendor-provided diagnostic tooling executed by administrators using non-standard
relative paths
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Arbitrary File Read or Delete via WaveStore alog/ilog Path Traversal
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects file access or deletion operations outside expected log directories performed by processes associated with WaveStore's alog/ilog scripts, indicating exploitation of path traversal file read/delete vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Arbitrary File Read or Delete via WaveStore alog/ilog Path Traversal
id: efd59104-a04e-5d84-a1ad-45a594e0ec9a
status: experimental
description: Detects file operations (read/delete) on paths containing directory traversal
sequences performed by processes named or invoked as alog/ilog, matching the behavior
of CVE-2025-65075 and CVE-2025-65076 which allow arbitrary file read/delete with
dvr or root privileges via WaveStore Server scripts.
references:
- CERT Polska coordinated disclosure - WaveStore Server path traversal RCE
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- alog
- ilog
selection_traversal:
TargetFilename|contains:
- ../
- ..%2f
- '%2e%2e%2f'
condition: selection_process and selection_traversal
falsepositives:
- Internal log rotation or archival tooling that legitimately traverses parent directories
to relocate log files
- Backup scripts referencing alog/ilog binaries with relative paths for restore operations
level: high
tags:
- attack.t1485
- attack.impact
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65074
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs