CVE-2025-26351

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0

Description: A Path Traversal issue in the template download mechanism allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. This issue enables the attacker to access confidential files through manipulated HTTP requests.

Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the template download mechanism to minimize the risk of exploitation. Avoid using the vulnerable template download feature until the issue is resolved.