CVE-2025-59890
Last modified
CVE-2025-59890 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-59890?
How severe is CVE-2025-59890?
How do I fix CVE-2025-59890?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59884Rejected reason: Not used
- CVE-2025-59885Rejected reason: Not used
- CVE-2025-59886Improper input validation at one of the endpoints of Eaton x…8.8
- CVE-2025-59887Improper authentication of library files in the Eaton UPS Co…8.6
- CVE-2025-59888Improper quotation in search paths in the Eaton UPS Companio…6.7
- CVE-2025-59889Improper authentication of library files in the Eaton IPP so…8.6
- CVE-2025-59891Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59892Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59893Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59894Cross-Site request forgery (CSRF) vulnerability in Sync Bree…8
- CVE-2025-59895Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…7.5
- CVE-2025-59896Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterp…5.4
Are you affected by CVE-2025-59890?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST