A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 1

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• trendmicro apex oneup to b1066 inclusive
• trendmicro apex one as a servicebefore 2019-03-27
• trendmicro business security9.0
• trendmicro officescan11.0
• trendmicro officescanxg
• trendmicro worry-free business security10.0
• trendmicro worry-free business security9.5

Versions reported by the vendor

Affected version ranges reported by the assigning authority (trendmicro). Independent of NVD's CPE analysis and usually ahead of it.

• Trend Micro Apex One, OfficeScan, Worry-Free Business Security

  • Apex One, OfficeScan XG, OfficeScan 11.0, Worry-Free Business Security 10, Worry-Free Business Security 9.5, Worry-Free Business Security 9.0affected

Other highest-scoring records for the same primary product.

• CVE-2025-54948A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious KEV
  76This week
• CVE-2020-8599Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary datKEV
  73This week
• CVE-2020-8467A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to eKEV
  68This week
• CVE-2020-8468Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escKEV
  67This week
• CVE-2023-41179A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security anKEV
  59Plan
• CVE-2022-40139Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients KEV
  59Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.