CVE-2025-9918
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution (RCE) via uploading a malicious ZIP archive containing path traversal sequences.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA path traversal vulnerability in the archive extraction component of Google SecOps SOAR Server allows authenticated attackers with Use Case import permissions to upload malicious ZIP archives containing path traversal sequences (e.g., ../../), enabling them to write files outside the intended extraction directory and achieve Remote Code Execution.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- Authentication
- X
- User interaction
- None
- Scope
- X
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify your Google SecOps SOAR Server versionLocate the installed version through the product's admin interface, system information panel, or by querying the version endpoint. Compare it against the affected range: versions prior to 6.3.54.0 or 6.3.53.2 are vulnerable.Affected if The installed version is lower than 6.3.53.2 or 6.3.54.0 (depending on your release track).
-
Determine if Use Case import permissions are assignedReview user role permissions in the administration panel. Check if any user accounts, service accounts, or API keys are granted the 'Use Case import' or 'Import Use Cases' permission capability.Affected if Any user account with Use Case import permissions exists in the system, as this is the attack vector for the vulnerability.
-
Inspect the archive extraction directory for unexpected filesExamine the designated import/extraction directory (typically the directory used for Use Case or playbook imports). Use file system inspection to identify any files written outside the expected subdirectory structure, particularly at parent directory levels.Affected if Files exist outside the intended extraction directory, or unexpected files appear in parent directories or system directories.
-
Review import/extraction logs for path traversal patternsSearch the SOAR Server logs (audit logs, import logs, or system logs) for ZIP archive extraction events. Look for entries containing '../' sequences or references to files written outside the import directory.Affected if Logs contain extraction events with path traversal sequences or indicate files written to paths outside the designated import directory.
You are affected if your Google SecOps SOAR Server version is below 6.3.53.2 or 6.3.54.0 AND any user account possesses Use Case import permissions, as this combination enables the path traversal attack vector.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedApply the vendor patch (upgrade to a version beyond 6.3.54.0/6.3.53.2) and implement input validation to sanitize or reject path traversal sequences in uploaded ZIP archives as a defense-in-depth measure.
Latest available Google SecOps SOAR Server version (newer than 6.3.54.0) - check official Google Cloud release notes for specific fixed version number
- Check current Google SecOps SOAR Server version via the admin console or system information page
- Navigate to the Google SecOps SOAR admin panel and locate the software update or upgrade section
- Review release notes at https://cloud.google.com Chronicle/SOAR release notes for CVE-2025-9918 fixed version
- If a newer version than 6.3.54.0 is available, schedule an upgrade during a maintenance window
- Before upgrading, back up the SOAR configuration and any custom Use Cases
- Perform the upgrade following Google's standard SOAR upgrade procedure
- After upgrade, verify the version has been updated successfully
- Confirm that the path traversal vulnerability in the archive extraction component is resolved by testing Use Case import with a safe test archive
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation3.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,592.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-9918 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-9918 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data