CVE-2025-8729: Medium Path Traversal in MigoXLab LMeterX

CVE-2025-8729 is a medium severity path traversal in MigoXLab LMeterX 1.2.0. The task_id value in the upload service is used to build a storage path, so a crafted value can escape the intended folder and write elsewhere on the server. The maintainers fixed it in commit f1b00597e293d09452aabd4fa57f3185207350e8.

What's affected

• Product: MigoXLab LMeterX, version 1.2.0.
• Component: process_cert_files in backend/service/upload_service.py, through the task_id argument of the upload endpoint.
• Weakness: CWE-22 (path traversal).
• Score: CVSS 3.1 base 6.3, Medium, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
• Fix: commit f1b00597e293d09452aabd4fa57f3185207350e8, titled "fix: issue #10". The upstream issue was closed by a maintainer on 30 July 2025 with a note that it was resolved, and the fix was merged through a hotfix branch.
• Fixed release number: not stated in the pages I read. Check the project's tags to see which release includes the commit.

The record describes the issue as "critical" in its description, while its score of 6.3 is Medium. The upstream issue title describes the result as arbitrary file overwrite. This post follows the score and notes both. The record says the exploit was disclosed publicly. It is not flagged as exploited in the wild and is not in the CISA Known Exploited Vulnerabilities catalog.

How to check if you're exposed

LMeterX is a load testing platform, and you may have deployed it as a container or from source. Find the running version and see whether it contains the fix commit.

git -C /path/to/LMeterX log --oneline | grep -i "issue #10"
git -C /path/to/LMeterX merge-base --is-ancestor f1b00597e293d09452aabd4fa57f3185207350e8 HEAD && echo fixed

If you run a container image, check which tag it was built from and when, and compare that with the commit date of 30 July 2025.

Then look at who can reach the upload endpoint. The vector says a low privileged account is needed. A load testing tool is often on an internal network, but internal does not mean safe if many people can log in or the service is exposed through a tunnel.

What to do now

1. Update LMeterX to a build that contains commit f1b0059, or newer.
2. If you cannot update yet, restrict the upload endpoint to trusted users and networks.
3. Run the service as a user that can write only to the folders it needs.
4. Check the upload directory and its neighbors for files you did not expect, and review the application's own files for changes.
5. Make sure uploaded files cannot overwrite code or configuration. A read only container file system helps.

Why it matters

Path traversal happens when software builds a file path from a value it should treat as a plain name. Sequences that mean parent folder get followed instead of stored. When the operation is a write, as it is here, the result can be overwriting a file the application or the host depends on.

The fix pattern is well known: validate the identifier against a strict format, build the path, resolve it, and refuse it if it falls outside the upload directory. The upstream commit matches that class of change. Many tools ship quickly and carry this bug in their first versions, so it is worth checking every internal tool that accepts a file and a name.

You can run the free in-browser dependency scan at gold.safeguard.sh/scan on your manifests to see which known-vulnerable packages you carry. It reads dependencies, so it will not see a flaw that lives only in an application's own source.

Try it yourself

Click through it at your own pace, or open it full screen.

This demo shows how to tell which findings already have a published fix you can apply today.

Quick check

Sources

• Safeguard Gold entry: CVE-2025-8729 (NVD record data: description, CVSS, CWEs, published 2025-08-08)
• Fix commit listed in the record: MigoXLab/LMeterX commit f1b0059
• Upstream issue: MigoXLab/LMeterX issue 10

Last reviewed: 18 October 2026.