What is CVE-2025-0124?

CVE-2025-0124 is a low-severity vulnerability in Palo Alto Networks Cloud Ngfw, classified under External Control of File Name or Path. CVSS score: 3.8/10. Published 2025-04-11.

How severe is CVE-2025-0124?

Low severity. CVSS v3 base score is 3.8 out of 10.

Vulnerability in Palo Alto Networks Cloud Ngfw

CVE-2025-0124

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limit…

EPSS: 0.003 (19.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L.

Affected products

Palo Alto Networks Cloud Ngfw — versions All
Palo Alto Networks Pan-os — versions 11.2.0, 11.1.0, 11.0.0
Palo Alto Networks Prisma Access — versions All
Paloaltonetworks Pan-os — versions 10.1.14

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path

References

psirt@paloaltonetworks.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2025-0124?: CVE-2025-0124 is a low-severity vulnerability in Palo Alto Networks Cloud Ngfw, classified under External Control of File Name or Path. CVSS score: 3.8/10. Published 2025-04-11.
How severe is CVE-2025-0124?: Low severity. CVSS v3 base score is 3.8 out of 10.