CVE-2025-6798— Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability
Quick assessment
Affected
Marvell QConvergeConsole
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Marvell QConvergeConsole是美国Marvell公司的一款跨数据中心的统一适配器管理软件。 Marvell QConvergeConsole存在路径遍历漏洞，该漏洞源于deleteAppFile方法未正确验证用户提供路径，可能导致任意文件删除。
Possible ATT&CK Techniques 1 AI
T1070.003 · Clear Command History
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-6798
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the deleteAppFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-24918.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Marvell QConvergeConsole 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Marvell QConvergeConsole是美国Marvell公司的一款跨数据中心的统一适配器管理软件。 Marvell QConvergeConsole存在路径遍历漏洞，该漏洞源于deleteAppFile方法未正确验证用户提供路径，可能导致任意文件删除。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Marvell | QConvergeConsole | 5.5.0.78 | - |
|
II. Public POCs for CVE-2025-6798
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-6798
请登录查看更多情报信息。
Same Patch Batch · Marvell · 2025-07-07 · 15 CVEs total
| CVE-2025-6796 | Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulner | |
| CVE-2025-6806 | Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerabilit | |
| CVE-2025-6801 | Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vuln | |
| CVE-2025-6795 | Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vuln | |
| CVE-2025-6793 | Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion an | |
| CVE-2025-6797 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vul | |
| CVE-2025-6803 | Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vu | |
| CVE-2025-6805 | Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vu | |
| CVE-2025-6807 | Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulne | |
| CVE-2025-6794 | Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerabilit | |
| CVE-2025-6800 | Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure V | |
| CVE-2025-6802 | Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vul | |
| CVE-2025-6804 | Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclos | |
| CVE-2025-6799 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vul |
IV. Related Vulnerabilities
Same product: QConvergeConsole
-
CVE-2025-8426
Marvell QConvergeConsole compressConfigFiles Directory Trave -
CVE-2025-6802
Marvell QConvergeConsole getFileFromURL Unrestricted File Up -
CVE-2025-6806
Marvell QConvergeConsole decryptFile Directory Traversal Arb -
CVE-2025-6807
Marvell QConvergeConsole getDriverTmpPath Directory Traversa -
CVE-2025-6795
Marvell QConvergeConsole getFileUploadSize Directory Travers
Same vendor: Marvell
-
CVE-2025-8426
Marvell QConvergeConsole compressConfigFiles Directory Trave -
CVE-2025-6802
Marvell QConvergeConsole getFileFromURL Unrestricted File Up -
CVE-2025-6806
Marvell QConvergeConsole decryptFile Directory Traversal Arb -
CVE-2025-6807
Marvell QConvergeConsole getDriverTmpPath Directory Traversa -
CVE-2025-6795
Marvell QConvergeConsole getFileUploadSize Directory Travers
Same weakness: CWE-22
-
CVE-2026-18899
Langflow is affected by multiple authentication bypass, path -
CVE-2026-55552
Yamcs: Unauthenticated Directory Traversal -
CVE-2026-55569
aqua: Archive extraction in aqua follows attacker-planted sy -
CVE-2026-82286
gpt-crawler Arbitrary File Write via outputFileName Paramete -
CVE-2026-82275
Qwen-Agent Arbitrary File Read via Caller-Supplied Document
V. Comments for CVE-2025-6798
No comments yet