PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25311 VideoFlow Ltd. CVE debrief

CVE-2018-25311 documents an authenticated directory traversal vulnerability in VideoFlow Digital Video Protection (DVP) version 2.10. The flaw exists in multiple Perl-based download endpoints—downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, and downloadFile.pl—where the ID parameter fails to sanitize path traversal sequences. Attackers with valid credentials can inject sequences such as ../ to traverse the filesystem and read arbitrary files, including sensitive system files like /etc/passwd. The vulnerability requires network access and valid authentication, resulting in a CVSS 4.0 score of 7.1 (HIGH). The CVE was published on 2026-04-29 and last modified on 2026-05-26. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.

Vendor
VideoFlow Ltd.
Product
VideoFlow Digital Video Protection
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-29
Original CVE updated
2026-05-26
Advisory published
2026-04-29
Advisory updated
2026-05-26

Who should care

Organizations running VideoFlow Digital Video Protection 2.10 for video content protection and DRM workflows; security teams managing legacy Perl-based web applications; incident responders investigating suspicious file access from video protection infrastructure.

Technical summary

The vulnerability stems from insufficient input validation in the ID parameter across five Perl CGI endpoints. An authenticated attacker can submit crafted requests with directory traversal payloads to read arbitrary files from the underlying operating system. The attack requires valid credentials, making credential compromise or insider threat a prerequisite for exploitation.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict network access to VideoFlow DVP administrative interfaces to trusted administrative hosts only
  • Implement Web Application Firewall (WAF) rules to detect and block path traversal sequences (../, ..%2f, etc.) in HTTP parameters
  • Review and apply any vendor-supplied patches for VideoFlow DVP; contact VideoFlow support if no patch is available
  • Monitor download endpoint logs (downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, downloadFile.pl) for anomalous ID parameter values containing traversal patterns
  • Consider disabling or removing unused download endpoints if functionality is not required
  • Implement file system access controls to prevent web application users from reading sensitive system files regardless of traversal success

Evidence notes

Vulnerability confirmed via NVD with CVSS 4.0 vector. Multiple independent security advisories from VulnCheck and Zero Science Lab corroborate the affected endpoints and traversal mechanism. Vendor attribution remains uncertain; 'VideoFlow' appears to be the product name with no confirmed vendor entity in available sources.

Official resources

2026-04-29