WaveStore Server path traversal flaws enable RCE
Three path traversal vulnerabilities in WaveStore Server allow high-privilege attackers to execute arbitrary commands, read/delete files, and gain root-level access.
CERT Polska coordinated the disclosure of three path traversal vulnerabilities in WaveStore Server software, affecting the WaveView client's ability to execute predefined commands and scripts. CVE-2025-65074 allows authenticated attackers with high privileges to execute arbitrary OS commands via path traversal in the showerr script. CVE-2025-65075 permits file read and deletion operations with dvr user permissions through the alog script, while CVE-2025-65076 enables arbitrary file read/delete with root privileges via the ilog script.
All three vulnerabilities require the attacker to possess high-level privileges on the WaveView client, but successfully escalate those privileges to execute commands or manipulate files on the connected WaveStore Server. The most critical of the three, CVE-2025-65076, runs with root privileges and represents a complete system compromise if exploited. The vendor has addressed all three issues in WaveStore Server version 6.44.44.
The vulnerabilities were responsibly disclosed by researcher Julia Zduńczyk through CERT Polska's coordinated vulnerability disclosure process. Organizations running WaveStore Server should immediately update to version 6.44.44 or later to remediate these flaws.
Mentioned in this report
Detection guidance
Suspicious Shell Execution via WaveStore Log/Error Script Path Traversal
Detects shell/command execution spawned with references to WaveStore showerr/alog/ilog scripts combined with path traversal sequences, indicating exploitation of CVE-2025-65074/65075/65076. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Execution via WaveStore Log/Error Script Path Traversal
id: a6b8363e-9f3a-513b-b91a-5b78bf5cf167
status: experimental
description: Detects command execution referencing WaveStore's showerr, alog, or ilog
scripts along with path traversal sequences (../ or URL-encoded equivalents), consistent
with exploitation of WaveStore Server path traversal vulnerabilities (CVE-2025-65074/65075/65076)
that allow arbitrary OS command execution.
references:
- CERT Polska coordinated disclosure - WaveStore Server path traversal RCE
logsource:
category: process_creation
product: linux
detection:
selection_script:
CommandLine|contains:
- showerr
- alog
- ilog
selection_traversal:
CommandLine|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- ..\\
condition: selection_script and selection_traversal
falsepositives:
- Legitimate maintenance scripts invoking these log utilities with relative paths
that happen to include '../' for valid parent directory navigation
- Vendor-provided diagnostic tooling executed by administrators using non-standard
relative paths
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Arbitrary File Read or Delete via WaveStore alog/ilog Path Traversal
Detects file access or deletion operations outside expected log directories performed by processes associated with WaveStore's alog/ilog scripts, indicating exploitation of path traversal file read/delete vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Arbitrary File Read or Delete via WaveStore alog/ilog Path Traversal
id: efd59104-a04e-5d84-a1ad-45a594e0ec9a
status: experimental
description: Detects file operations (read/delete) on paths containing directory traversal
sequences performed by processes named or invoked as alog/ilog, matching the behavior
of CVE-2025-65075 and CVE-2025-65076 which allow arbitrary file read/delete with
dvr or root privileges via WaveStore Server scripts.
references:
- CERT Polska coordinated disclosure - WaveStore Server path traversal RCE
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- alog
- ilog
selection_traversal:
TargetFilename|contains:
- ../
- ..%2f
- '%2e%2e%2f'
condition: selection_process and selection_traversal
falsepositives:
- Internal log rotation or archival tooling that legitimately traverses parent directories
to relocate log files
- Backup scripts referencing alog/ilog binaries with relative paths for restore operations
level: high
tags:
- attack.t1485
- attack.impact
author: Vorant
Path Traversal Request to WaveView Log/Error Script Endpoints
Detects HTTP requests to WaveStore/WaveView showerr, alog, or ilog endpoints containing directory traversal sequences, indicative of reconnaissance or exploitation attempts against CVE-2025-65074/65075/65076. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Request to WaveView Log/Error Script Endpoints
id: 25384875-1a6f-5fe7-bd71-2250864d71b3
status: experimental
description: Detects web requests targeting WaveStore Server's showerr, alog, or ilog
scripts with path traversal sequences in the query string or URI, consistent with
attempts to enumerate or read/delete arbitrary files or execute commands as described
in the WaveStore Server path traversal disclosures.
references:
- CERT Polska coordinated disclosure - WaveStore Server path traversal RCE
logsource:
category: proxy
product: windows
detection:
selection_endpoint:
cs-uri-query|contains:
- showerr
- alog
- ilog
selection_traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- ..%5c
condition: selection_endpoint and selection_traversal
falsepositives:
- Automated vulnerability scanners intentionally probing for path traversal as part
of authorized security testing
- Misconfigured monitoring tools passing relative file paths to these endpoints
level: medium
tags:
- attack.t1083
- attack.discovery
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65074
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free