CVE-2025-37094 is a Medium severity (CVSS 5.5) directory traversal flaw in HPE StoreOnce Software that allows arbitrary file deletion. The vector needs high privileges. HPE's bulletin hpesbst04847en_us names the fixed release, so check your version and upgrade. Check your version first.
What's affected
The record names HPE StoreOnce Software, and HPE's bulletin is hpesbst04847en_us. The record does not give version numbers, and the HPE page loads through scripts that I could not read automatically, so I cannot state affected or fixed versions here.
Open the bulletin and note the StoreOnce releases it lists, and the release it names as the fix. The same bulletin covers several CVEs, so one upgrade should cover all of them.
How to check if you're exposed
Note the StoreOnce Software version that your management interface reports, and compare it with the affected and fixed versions in the HPE bulletin. If you run more than one StoreOnce system, check each, including virtual appliances and any used only for lab or archive copies.
Also confirm which network segments can reach the management and data interfaces. Backup appliances are common ransomware targets, so exposure should be limited to backup and admin hosts.
What to do now
- Find every StoreOnce system and its software version.
- Open HPE bulletin hpesbst04847en_us and identify the fixed release.
- Schedule the upgrade, and test restores before and after the change.
- Restrict management and data interface access to the backup network and admin hosts.
- Review the appliance's accounts and logs for anything unexpected while you were on the old version.
Why it matters
The weakness is CWE-22 (Path Traversal). A file path from outside input is not kept inside the intended directory, so a request can reach files elsewhere on the system. Here the effect is deletion.
The vector needs high privileges and shows low integrity impact and high availability impact. Deleting the wrong file on an appliance can break it, and on a backup platform an availability loss can mean failed backups or restores. This is the lowest scored of the seven StoreOnce CVEs, but it is fixed by the same upgrade. HPE published seven StoreOnce CVEs in one bulletin on the same day, which are CVE-2025-37089, CVE-2025-37090, CVE-2025-37091, CVE-2025-37092, CVE-2025-37094, CVE-2025-37095 and CVE-2025-37096.
Quick check
Which version fixes CVE-2025-37094?
The record gives no version. HPE bulletin hpesbst04847en_us lists the fix, so read it directly.
Why is the score only Medium?
The vector needs high privileges and affects integrity at a low level. Availability impact is high, so do not ignore it on a backup system.
Sources
Last reviewed: 18 October 2026.
