CVE-2025-34185 is a pre-authentication file disclosure vulnerability in Ilevia Srl.'s EVE X1 Server (≤ 4.7.18.0.eden). Attackers can exploit the 'db_log' POST parameter to retrieve arbitrary files from the server, leading to exposure of sensitive information and credentials. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-22 (Path Traversal). The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows remote unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive system information and credentials. This can lead to further compromise depending on the nature of the disclosed data. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the EVE X1 Server and monitor for suspicious POST requests targeting the 'db_log' parameter. Avoid exposing the server directly to untrusted networks.