CVE-2026-25760 in Sliver
Summary
by MITRE • 02/07/2026
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/07/2026
The vulnerability identified as CVE-2026-25760 affects the Sliver command and control framework, a sophisticated tool used for post-compromise operations in cybersecurity. This framework operates using a custom Wireguard netstack implementation for secure communications between command and control servers and compromised hosts. The vulnerability exists within the website content subsystem of Sliver versions prior to 1.6.11, representing a critical security flaw that undermines the integrity of the system's access controls. The issue manifests as an authenticated path traversal vulnerability that allows operators with valid credentials to escalate their privileges and access arbitrary files on the server host. This represents a significant deviation from the expected security boundaries of the application, as legitimate authenticated users should not be able to bypass file access restrictions to read sensitive system files.
The technical flaw stems from inadequate input validation within the website content subsystem's file handling mechanisms. When an authenticated operator makes requests to the web interface, the application fails to properly sanitize user-supplied paths, allowing attackers to manipulate file access parameters through directory traversal sequences. This vulnerability directly maps to CWE-22, which describes path traversal or directory traversal vulnerabilities where attackers can access files and directories outside the intended scope. The flaw operates by accepting user input that should be restricted to specific content directories but instead permits navigation to arbitrary locations within the filesystem. Attackers can exploit this by crafting malicious requests that include sequences like "../" to traverse up directory trees and access sensitive files such as configuration files, credential stores, and cryptographic keys that should remain protected within the server's file system.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it provides attackers with access to critical system components that could compromise the entire security infrastructure. An attacker with authenticated access can potentially read configuration files that contain database connection strings, API keys, and other sensitive credentials that may grant access to additional systems. The exposure of cryptographic keys and certificates stored on the server could lead to complete compromise of the command and control infrastructure, allowing attackers to impersonate legitimate Sliver servers and potentially gain access to all connected compromised systems. This vulnerability also violates fundamental security principles of least privilege and defense in depth, as it allows authenticated users to bypass normal access controls and escalate their privileges to read system files that should only be accessible to system administrators or the application itself. The potential for lateral movement within networks increases significantly when attackers can extract sensitive configuration data and authentication tokens.
Mitigation strategies for CVE-2026-25760 primarily involve immediate upgrading to Sliver version 1.6.11 or later, which contains the necessary patches to address the path traversal vulnerability. Organizations should also implement additional security measures including regular security audits of the web interface components, implementation of strict input validation controls, and monitoring for unusual file access patterns. Network segmentation and access control policies should be reviewed to ensure that only necessary personnel have authenticated access to the Sliver management interface, reducing the attack surface. The vulnerability demonstrates the importance of proper secure coding practices and input validation, particularly within web application components that handle user-supplied data. Security teams should also consider implementing automated vulnerability scanning tools that can detect similar path traversal patterns in other applications within their environment, as this represents a common attack vector that affects numerous software frameworks and applications. The fix for this vulnerability aligns with ATT&CK technique T1566, which covers credential harvesting through various methods including exploitation of software vulnerabilities, and emphasizes the need for robust application security controls to prevent unauthorized access to system resources.