CVE-2025-66955 in SEE Live
Summary
by MITRE • 03/12/2026
Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/20/2026
The vulnerability identified as CVE-2025-66955 represents a critical local file inclusion flaw within the Asseco SEE Live 2.0 platform that affects multiple communication components including Contact Plan, E-Mail, SMS, and Fax modules. This security weakness exists in the API endpoints responsible for file handling operations, specifically the downloadAttachment and downloadAttachmentFromPath functions that process user-supplied path parameters. The vulnerability is particularly concerning because it allows remote authenticated attackers to manipulate file access controls and potentially read sensitive files from the server filesystem, creating a significant attack surface for privilege escalation and data exfiltration.
The technical implementation of this flaw stems from insufficient input validation and sanitization within the path parameter processing logic of the affected API calls. When authenticated users submit malicious path values through the downloadAttachment and downloadAttachmentFromPath endpoints, the system fails to properly validate or sanitize these inputs before using them to construct file system paths. This creates an opportunity for attackers to traverse directory structures and access files that should normally be restricted, potentially including configuration files, database credentials, application source code, or other sensitive system resources. The vulnerability operates under CWE-22 which classifies it as a Directory Traversal attack, where attackers can manipulate file path inputs to access unintended resources.
The operational impact of this vulnerability extends beyond simple file access, as it can enable attackers to escalate privileges and gain unauthorized access to critical system information. An authenticated attacker could potentially access application configuration files containing database connection strings, encryption keys, or other sensitive credentials that would allow further compromise of the system. Additionally, the vulnerability could facilitate information disclosure attacks where attackers might extract proprietary code, business logic, or user data that could be used for additional attacks or financial gain. The remote authentication requirement reduces the attack surface compared to local vulnerabilities, but still represents a serious risk given that legitimate users already have access to the system.
Organizations utilizing Asseco SEE Live 2.0 should implement immediate mitigations including input validation and sanitization of all path parameters in API endpoints, implementation of proper access controls and file system permissions, and deployment of web application firewalls to monitor and filter suspicious requests. The principle of least privilege should be enforced to ensure that file access operations are restricted to only necessary components and users. Regular security assessments and code reviews should be conducted to identify similar vulnerabilities in other API endpoints, while also implementing proper logging and monitoring of file access operations to detect potential exploitation attempts. This vulnerability aligns with ATT&CK technique T1213 which covers Data from Information Repositories, and T1566 which addresses credential access through various attack vectors, making comprehensive security controls essential for protecting against exploitation.