CVE-2025-63414 is a critical security vulnerability identified in the Allsky WebUI, specifically in the version dated 2024.12.06_06. The flaw is a path traversal vulnerability (CWE-22) combined with command injection (CWE-78) that allows an unauthenticated remote attacker to achieve arbitrary command execution on the server hosting the WebUI. The vulnerability exists in the /html/execute.php endpoint where the id parameter is improperly sanitized, enabling attackers to craft HTTP requests that traverse directories and inject operating system commands. This results in full remote code execution (RCE) with no authentication or user interaction required. The CVSS v3.1 score is 10.0, reflecting the highest severity due to network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Although no public exploits have been reported yet, the vulnerability’s nature and ease of exploitation make it a critical risk. The lack of available patches at the time of publication increases the urgency for defensive measures. The vulnerability could be exploited to take full control of affected systems, steal sensitive data, disrupt services, or use compromised hosts as pivot points in broader attacks.

For European organizations, this vulnerability poses a severe risk due to the potential for complete system compromise without any authentication barrier. Confidentiality is at risk as attackers can access sensitive data stored or processed by the affected systems. Integrity is compromised because attackers can alter system files, configurations, or data. Availability is threatened as attackers could disrupt or disable services by executing destructive commands. Critical infrastructure, research institutions, and enterprises using Allsky WebUI could face operational disruptions, data breaches, and reputational damage. The vulnerability’s exploitation could also facilitate lateral movement within networks, increasing the scope of impact. Given the high CVSS score and the lack of patches, organizations face an urgent need to assess exposure and implement mitigations. The threat is particularly acute in sectors with high-value targets or regulatory requirements for data protection, such as finance, healthcare, and government entities across Europe.

1. Immediately restrict network access to the /html/execute.php endpoint by implementing firewall rules or network segmentation to limit exposure to trusted IP addresses only. 2. Monitor web server logs for suspicious requests targeting the id parameter or unusual command execution patterns. 3. Deploy web application firewalls (WAFs) with custom rules to detect and block path traversal and command injection attempts targeting this endpoint. 4. Conduct thorough code reviews and input validation improvements to sanitize the id parameter and prevent directory traversal and command injection. 5. Engage with the Allsky WebUI vendor or community to obtain patches or updates addressing this vulnerability as soon as they become available. 6. Implement intrusion detection systems (IDS) tuned to detect exploitation attempts of this specific vulnerability. 7. Educate IT and security teams about the vulnerability and ensure incident response plans include scenarios involving remote code execution attacks. 8. Consider isolating or decommissioning vulnerable instances until a secure version is deployed. 9. Regularly back up critical data and verify recovery procedures to mitigate potential damage from exploitation.