6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25760

CVE-2026-25760: Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25760

CVE-2026-25760:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/bishopfox/sliver	go	<= 1.6.10	1.6.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal that allows an authenticated user to read arbitrary files on the server. The analysis of the provided information, including the detailed vulnerability description and the commit patch, reveals two key functions involved in this vulnerability.

SliverRPC.WebsiteAddContent in server/rpc/rpc-website.go: This is the entry point of the vulnerability. It's a gRPC method that allows an operator to add content to a website. The vulnerability description explicitly states that this function accepts a content.Path from the operator and persists it without proper validation. This allows an attacker to save a malicious path (e.g., ../../../../etc/passwd) in the database.
Website.ToProtobuf in server/db/models/website.go: This function is responsible for preparing the website content to be sent over gRPC. The provided patch clearly shows that this function was vulnerable. Before the fix, it used os.ReadFile(filepath.Join(webContentDir, webcontent.Path)) to read the content of a file. The webcontent.Path is the value that was previously stored via WebsiteAddContent. Since this path is not sanitized, filepath.Join does not prevent the path traversal, leading to an arbitrary file read. The patch fixes this by using a non-user-controllable identifier (webcontent.ID.String()) to construct the file path, thus mitigating the vulnerability.

Therefore, an exploit would first call WebsiteAddContent to store a malicious path, and then trigger a call to Website.ToProtobuf (likely via the Website gRPC method) to read and retrieve the content of an arbitrary file on the server.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.