CVE-2019-25355: 
NixOS vulnerability analysis and mitigation

CVE-2019-25355 is a directory traversal vulnerability in gSOAP 2.8 (developed by Genivia Inc.) that allows unauthenticated remote attackers to read arbitrary system files by sending crafted HTTP GET requests containing ../ path traversal sequences. The vulnerability was published on February 18, 2026, and affects gSOAP version 2.8.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High), with the primary impact being a complete loss of confidentiality (Feedly, Exploit-DB).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 / Path Traversal). An attacker exploits this by sending a crafted HTTP GET request to a gSOAP-based service endpoint, embedding multiple ../ sequences in the URL path to escape the intended web root and access arbitrary files on the underlying filesystem — for example, retrieving /etc/passwd. No authentication, user interaction, or special privileges are required, and the attack is conducted entirely over the network. A public proof-of-concept exploit is available on Exploit-DB (EDB-47653) (Exploit-DB, Feedly).

Successful exploitation allows an unauthenticated attacker to read arbitrary files accessible to the gSOAP service process, including sensitive system files such as /etc/passwd, application configuration files, and potentially credential stores. The impact is limited to confidentiality — there is no integrity or availability impact. Exposure of credential material or configuration secrets could facilitate lateral movement or privilege escalation in a broader attack chain (Feedly).

A public proof-of-concept exploit is available on Exploit-DB (EDB-47653), lowering the barrier to exploitation significantly. As of the available intelligence, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.56%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 299613 is available for detection (Exploit-DB, Tenable, Feedly).

1. Reconnaissance: Identify internet-facing services built on gSOAP 2.8 using network scanners (e.g., Shodan, Censys) or by fingerprinting HTTP responses characteristic of gSOAP endpoints.
2. Craft traversal payload: Construct an HTTP GET request with multiple ../ sequences in the URL path to traverse out of the web root, e.g., GET /../../../../etc/passwd HTTP/1.1.
3. Send request: Transmit the crafted request to the target gSOAP service without any authentication headers or special preconditions.
4. Retrieve file contents: If the service is vulnerable, the response body will contain the contents of the targeted file (e.g., /etc/passwd), which can then be used for further reconnaissance or credential attacks (Exploit-DB, Feedly).

• Network: HTTP GET requests to gSOAP service endpoints containing repeated ../ sequences in the URL path (e.g., GET /../../../../etc/passwd).
• Logs: Web/application access logs showing requests with URL-encoded or raw path traversal patterns (%2e%2e%2f, ../, ..%2f) targeting sensitive file paths such as /etc/passwd, /etc/shadow, or application config files.
• Process: Unexpected file reads by the gSOAP service process on sensitive system files outside the expected web root directory.

Users should upgrade to a patched version of gSOAP from Genivia if one is available; patch availability was not explicitly confirmed in the advisory data at time of publication. As interim mitigations: implement input validation and sanitization to reject requests containing ../ or URL-encoded equivalents; deploy Web Application Firewall (WAF) rules to block path traversal patterns; restrict OS-level file permissions so the gSOAP service account cannot read sensitive files outside its intended scope; and enable authentication/access controls on the gSOAP service where feasible. Monitor access logs for path traversal attempts (Feedly, Tenable).