CVE-2025-0105 is a critical (CVSS 9.1) arbitrary file deletion in Palo Alto Networks Expedition. An unauthenticated attacker can delete files that the www-data user can reach. Versions below 1.2.101 are affected, and the product is end of life, so upgrade to 1.2.101 or later, or better, retire the tool.
What's affected
The record names Palo Alto Networks Expedition, the free tool used to migrate firewall configurations to Palo Alto Networks next generation firewalls. Palo Alto Networks advisory PAN-SA-2025-0001, published 2025-01-08, says Expedition versions below 1.2.101 are affected and 1.2.101 and later are unaffected. The advisory states that no special configuration is needed to be affected.
Expedition reached end of life on December 31, 2024, and the advisory says no additional updates are planned or provided. The advisory also says Expedition is meant to be used only temporarily for migration and not to be run in production. It does not affect firewalls, Panorama appliances, Prisma Access or Cloud NGFWs.
The record says this issue lets an unauthenticated attacker delete arbitrary files accessible to the www-data user on the host filesystem. That account runs the web application, so files it can write include the application's own files and data.
The same advisory covers CVE-2025-0103, CVE-2025-0104, CVE-2025-0106 and CVE-2025-0107. The advisory scores this issue lower than the NVD base score used in the title because it applies a different scoring method (CVSS 4.0 with threat and environment adjustments). We use the record's score here and recommend that you read the advisory for the vendor view. The advisory states that Palo Alto Networks is not aware of any malicious exploitation of these issues.
How to check if you're exposed
Find any Expedition servers, including ones set up for a past migration and forgotten.
- Search virtual machine inventories, cloud accounts and lab networks for hosts named after Expedition or the Migration Tool.
- Log in to the web interface and read the version. Anything below 1.2.101 is affected.
- Check who can reach the host. The advisory says no special configuration is needed, so reachability decides the risk.
- Look at what the host stores: uploaded firewall configurations, API keys and credentials.
If the tool is no longer needed, that is the simplest fix.
What to do now
- Find every Expedition installation and note the version.
- Upgrade to 1.2.101 or later if you must keep running it, and read the advisory on the end of life status.
- Prefer shutting down Expedition once the migration is finished.
- Restrict network access to the host to the people who need it.
- Rotate firewall API keys, credentials and passwords that were ever stored in or handled by Expedition.
- Review PAN-OS device credentials for any systems whose configuration passed through the tool.
Why it matters
Deleting files sounds less severe than reading them, but on an application host it can break the service, remove logs that would show an attack and, in some setups, remove files that protect something else, for example a lock file or a configuration that falls back to a weaker default.
The class is external control of a file name or path. The fix pattern is to ignore file names from the request, map identifiers to files on the server side, and run the web account with write access to only one data folder. The advisory rates this issue low using its own method, and the NVD base score is much higher, which is a good reminder to compare scores with the exposure of the host.
The weakness class is CWE-73: External Control of File Name or Path. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which scores 9.1. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Which version fixes it?
Palo Alto Networks lists 1.2.101 and later as unaffected.
Will there be more updates?
The advisory says Expedition reached end of life on December 31, 2024, and no additional updates are provided.
Sources
Last reviewed: 19 October 2026.
