HighPublic exploit

Path Traversal in RIPS Scanner 0.54 windows/code.php

IdentifiersCVE-2025-34126CWE-22· Improper Limitation of a Pathname…

CVE-2025-34126 is a path traversal vulnerability in RIPS Scanner version 0.54. The issue is present in the web-accessible 'windows/code.php' script, which insufficiently restricts or sanitizes the user-supplied 'file' parameter in HTTP GET requests. By manipulating this parameter with traversal sequences, a remote attacker can cause the application to access files outside the intended directory scope and return their contents. This enables arbitrary file read on the underlying system in the security context of the web server process, resulting in exposure of sensitive local files and application data.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to read arbitrary files on the target system with the privileges of the web server account. This can disclose sensitive information such as application source code, configuration files, credentials stored in local files, system information, and other data useful for follow-on compromise.

Mitigation

If you can’t patch tonight, do this now.

Restrict network access to the 'windows/code.php' endpoint, especially from untrusted users or the public Internet. Implement strict validation and sanitization of the 'file' parameter, preferably replacing direct path input with server-side allowlisted identifiers. Add web server or WAF rules to detect and block traversal patterns such as '../' and encoded equivalents. Run the web server with minimal filesystem privileges to limit readable files if exploitation occurs.

Remediation

Patch, then assume compromise.

Upgrade RIPS Scanner to a fixed version if one is made available by the vendor, or apply any official vendor patch addressing the vulnerable handling of the 'file' parameter in 'windows/code.php'. If no fix is available, remove or disable the vulnerable script. The underlying code should be corrected to enforce strict allowlisting of accessible files, canonicalize paths before use, and reject traversal sequences or any path resolving outside the intended directory.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

rips_traversal.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit auxiliary scanner module targeting a directory traversal vulnerability in RIPS Scanner v0.54 (CVE-2025-34126). The module, written in Ruby, is designed to exploit the vulnerable 'code.php' endpoint by sending a GET request with a crafted 'file' parameter containing directory traversal sequences. The attacker can specify the file to read (default: /etc/passwd) and the traversal depth. If successful, the module extracts the file contents from the HTML response and saves it as loot. The module is operational and provides file exfiltration capabilities but does not provide a shell or code execution. The only code file is the Metasploit module itself, and it is structured with standard Metasploit conventions, including option registration and result reporting. The main fingerprintable endpoints are the vulnerable code.php path and the file paths targeted for reading.

rubynetwork

ACTIVITY FEED

Recent activity

4 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

4 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4