CVE-2026-25760: 
vulnerability analysis and mitigation

CVE-2026-25760 is an authenticated path traversal / arbitrary file read vulnerability in BishopFox's Sliver command-and-control (C2) framework. It affects all versions of Sliver prior to 1.6.11 (specifically confirmed in version 1.6.10 and earlier) and was disclosed on February 5, 2026. The flaw resides in the website content subsystem and allows an authenticated operator to read arbitrary files on the Sliver server host, potentially exposing credentials, configurations, and cryptographic keys. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, BishopFox Advisory).

The root cause (CWE-22: Path Traversal) lies in two server-side components: server/rpc/rpc-website.go:100 accepts an operator-supplied content.Path value via the WebsiteAddContent gRPC call and persists it without validation, and server/db/models/website.go:52 later reads from disk using filepath.Join(webContentDir, webcontent.Path) without sanitizing or constraining the path. Because Go's filepath.Join does not prevent directory traversal sequences (../), an attacker can supply a path such as ../../../../../../../../etc/passwd to escape the web content directory and read any file accessible to the Sliver server OS user. Exploitation requires an authenticated operator account with sufficient permissions (e.g., PermissionAll), and a full proof-of-concept (PoC) is publicly available in the security advisory (BishopFox Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to read arbitrary files on the Sliver server host as the OS user running the Sliver process, with high confidentiality impact and no integrity or availability impact. Sensitive data at risk includes operator configuration files, TLS certificates, authentication tokens, private keys, and server logs. Because Sliver is a C2 framework managing implants across potentially many compromised hosts, exposure of operator credentials or keys could enable an attacker to pivot into the broader Sliver infrastructure and the systems it controls (BishopFox Advisory, GitHub Advisory).

1. Obtain operator credentials: Acquire a valid Sliver operator configuration file (.cfg) with sufficient permissions (e.g., PermissionAll) that grants access to website management gRPC operations.
2. Connect to the Sliver server: Use the Sliver client or the PoC tool to establish an mTLS connection to the target Sliver server using the operator config: transport.MTLSConnect(config).
3. Craft a traversal path: Construct a web path that traverses out of the web content directory to the target file, e.g., for /etc/passwd: webPath = "../../../../../../../../etc/passwd".
4. Submit malicious content via WebsiteAddContent: Call the WebsiteAddContent gRPC method with the traversal path as the Path field in the WebContent map. The server accepts and persists this path without validation.
5. Retrieve the file contents: Call the Website gRPC method to retrieve the website's contents. The server executes os.ReadFile(filepath.Join(webContentDir, webcontent.Path)), which resolves the traversal and reads the target file from disk.
6. Extract the leaked data: Parse the returned WebContent entries to find the entry matching the traversal path and read the Content field, which contains the raw bytes of the targeted server file (BishopFox Advisory).

• Network: Unusual or unexpected gRPC calls to the Sliver server's operator port (default 31337) from unfamiliar operator IPs; mTLS connections from operator accounts not recognized by administrators.
• Logs: Sliver server logs showing WebsiteAddContent calls with path values containing ../ sequences or absolute paths (e.g., ../../../../../../../../etc/passwd); repeated Website gRPC calls immediately following WebsiteAddContent calls from the same operator session.
• File System: Unexpected website entries in the Sliver database containing path values that traverse outside the web content directory; new website names (e.g., poc-site) created by operator accounts not associated with legitimate operations.
• Process: File read operations by the Sliver server process targeting sensitive files outside its expected working directories (e.g., /etc/passwd, /etc/shadow, operator config directories, TLS key stores) (BishopFox Advisory).

Upgrade Sliver to version 1.6.11 or later, which fixes the vulnerability by changing website.ToProtobuf() to read files by content UUID rather than the operator-supplied path (filepath.Join(webContentDir, webcontent.ID.String())), eliminating the traversal vector (Fix Commit). As interim mitigations, restrict network access to the Sliver operator port to only trusted IP addresses, audit and minimize operator account permissions, and monitor for suspicious WebsiteAddContent gRPC calls. If a compromise is suspected, rotate all credentials, TLS keys, and authentication tokens that may have been exposed (GitHub Advisory).