CVE-2025-20059
Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
- EPSS probability
- 0.93%
- CWE
- CWE-23
- Published
- 2025-02-20
- Last modified
- 2026-03-12
Affected products
- Ping Identity PingAM Java Policy Agent
Weakness type
Related vulnerabilities
- CVE-2026-84939 — Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
- CVE-2026-15913 — Path Traversal in Fortra's GoAnywhere MFT Endpoint
- CVE-2026-79728 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87747 — Ragic｜Enterprise Cloud Database - Arbitrary File Read
- CVE-2026-47680 — Source controller: Improper path handling allows traversal
- CVE-2026-77897 — Microsoft Power Automate Desktop Elevation of Privilege Vulnerability
- CVE-2026-72948 — Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-67367 — A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE...