CVE-2025-43889 MEDIUM

CVE-2025-43889

Vendor Dell
Product PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
Weakness CWE-22 · Path traversal
Published October 7, 2025
Last update October 7, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4, LTS2024 release Versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Key dates

02Disclosure timeline

October 7, 2025 CVE published
October 7, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-43815 Grafana directory traversal for `.cvs` files CVE-2026-40909 WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) CVE-2026-33949 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files CVE-2023-52085 Winter CMS Local File Inclusion through Server Side Template Injection CVE-2025-30594 WordPress Include URL plugin <= 0.3.5 Arbitrary File Download Vulnerability