CVE-2025-54945: Critical Path Control Command Execution in SUNNET CTMS

CVE-2025-54945 is a critical flaw in SUNNET Corporate Training Management System before version 10.11. Attackers control the destination file path of a malicious file and can run arbitrary system commands. Obtain version 10.11 or later from SUNNET Technology, and keep the system away from untrusted networks until you do.

What's affected

• Product: SUNNET Corporate Training Management System, from SUNNET Technology Co., Ltd.
• Affected: versions before 10.11.
• Fixed: version 10.11 or later, per the version boundary in the record. The researcher's advisory says to contact SUNNET Technology for version updates, so ask the vendor for the current release and installation steps.
• What it allows: remote attackers can execute arbitrary system commands via a malicious file by controlling the destination file path.

This is one of five related findings published together by the same researcher team (CVE-2025-54942 through CVE-2025-54946). They affect the same product and the same version range, so one upgrade addresses all of them. Plan the work as a single change.

How to check if you're exposed

This is a vendor application, so check it where it is installed.

• Find the product version in the administration pages or the installer record, and compare it with 10.11.
• Ask your SUNNET Technology contact which release you are on and whether all five advisories are covered.
• Check whether the system is reachable from the internet. A training portal often is, because staff and contractors use it from outside.
• Look at web server logs for unusual requests to deployment or upload functionality from addresses you do not recognize.

Because the vendor ships it as a packaged system, a library scan will not see it. Add it to your asset inventory with an owner and a patch contact.

What to do now

1. Contact SUNNET Technology and obtain version 10.11 or later, with the vendor's upgrade instructions.
2. Take a backup of the application and its database before you upgrade.
3. If you cannot upgrade immediately, restrict access to the system to trusted networks or a VPN, and place a web application firewall in front of it if you have one.
4. Review the server for files you did not put there, in particular in upload and deployment locations, and review logs back to the start of September 2025 at least.
5. Record the upgrade and the check in your vulnerability tracker, covering all five related CVEs.

Why it matters

The weakness is external control of a file name or path. When a user can choose where a file is written, they can choose a location that matters, such as a place the system later executes or loads. Path handling bugs are often paired with upload bugs, which is the case here: CVE-2025-54944 covers the dangerous upload itself.

Defenders should build paths on the server from fixed directories and generated names, and reject anything containing separators or traversal sequences. Never join raw user input to a directory path. The researcher's advisory scores this entry 10 on CVSS 4.0, the highest of the five, reflecting remote reach with no privileges.

The researcher's advisory (ZA-2025-13) lists the mitigation as contacting the vendor for version updates, and gives no workaround. The CVE is not on the CISA KEV list.

The weakness is classed as CWE-73 (External Control of File Name or Path). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Quick check

Sources

• ZUSO ART advisory ZA-2025-13

Last reviewed: 18 October 2026.