CVE-2025-14728: 
Velociraptor vulnerability analysis and mitigation

CVE-2025-14728 is a directory traversal vulnerability in Rapid7 Velociraptor affecting all versions before 0.75.6 on Linux servers. It allows a rogue (compromised or malicious) client to upload files that are written outside the intended datastore directory due to insufficient sanitization of directory names ending with a period ("."). The vulnerability was published on December 29, 2025, and a patch was made available in version 0.75.6. It carries a CVSS v3.1 base score of 6.8 (Medium/High) (Velociraptor Advisory, Red Hat CVE).

The root cause is improper path sanitization (CWE-22: Path Traversal) in Velociraptor's file upload handling on Linux. When a client uploads a file, the server encodes directory names to prevent traversal; however, directory names ending with "." are only partially sanitized — the trailing period is encoded as "%2E" but the traversal sequence is not fully neutralized, allowing the resulting path to resolve outside the datastore directory. Exploitation requires a rogue client (i.e., an attacker who controls or compromises a Velociraptor client endpoint) and is limited by the constraint that the containing directory in the traversed path must end with "%2E", which prevents overwriting arbitrary critical system files (Velociraptor Advisory).

A rogue Velociraptor client can write files to unintended locations on the Linux server's filesystem, outside the protected datastore directory. This primarily affects system integrity, as an attacker could plant malicious files, configuration overrides, or scripts in directories accessible to the Velociraptor service account. The constraint that the parent directory must end with "%2E" limits the practical impact and prevents overwriting most critical system files, reducing the risk of immediate full system compromise (Velociraptor Advisory, Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-14728. The EPSS score is approximately 0.25%, indicating a low probability of near-term exploitation. The attack complexity is rated High, as exploitation requires control over a Velociraptor client (i.e., a rogue or compromised endpoint). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Velociraptor Advisory).

1. Gain control of a Velociraptor client: The attacker must control or compromise a host running the Velociraptor agent that is enrolled with the target server.
2. Craft a malicious upload request: Construct a file upload request where the target directory path contains a component ending with "." (e.g., ../../some/path/malicious.), exploiting the incomplete sanitization that only encodes the trailing period as "%2E".
3. Submit the upload to the server: Send the crafted upload through the Velociraptor client-server communication channel, causing the server to write the file to a path outside the datastore directory.
4. Achieve file write outside datastore: The server writes the attacker-controlled file to the traversed location (constrained to directories ending in "%2E"), potentially enabling persistence, configuration tampering, or staging for further attacks (Velociraptor Advisory).

• File System: Unexpected files appearing in directories outside the Velociraptor datastore directory, particularly in directories whose names end with "%2E" or "."; new or modified files in locations not normally written by the Velociraptor service account.
• Logs: Velociraptor server logs showing file upload operations with paths containing "%2E" or unusual directory traversal sequences (e.g., "../") in the destination path.
• Process: Velociraptor server process writing files to unexpected filesystem locations as observed via auditd or inotify monitoring on Linux.

Rapid7 has released Velociraptor version 0.75.6, which addresses this vulnerability by improving sanitization of directory names in file upload paths. Administrators running Velociraptor on Linux servers should upgrade to version 0.75.6 or later as the primary remediation. No specific configuration-based workaround has been published; restricting which clients can enroll with the server and monitoring for unauthorized client connections can reduce exposure in the interim (Velociraptor Advisory).