External risk intelligence

Desktop Alert PingAlert Directory Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-54347

The vulnerability affects an Application Server component. Application servers are typically deployed as network-accessible services to facilitate communication, API endpoints, or centralized management, making them commonly reachable in environments where such alerting or messaging infrastructure is utilized.

Path Traversal

Desktopalert Pingalert Application Server

6.1.0.11 to before 6.1.1.6

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A Directory Traversal vulnerability has been identified in the Desktop Alert PingAlert Application Server, potentially allowing unauthorized users to write arbitrary files. This issue impacts specific versions of the software.

Attackers may write unwanted files to systems.
Confirm if this server software is in use.
Verify operational relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could exploit this vulnerability by accessing the application server over the network. They can then craft a request to overwrite arbitrary files on the server, potentially leading to system compromise.

Requires authenticated access.
Triggered by sending a malicious request.
Risk of arbitrary file overwrite.

Live Threat

Current exploitation, exposure, and threat context

A Directory Traversal vulnerability in Desktop Alert PingAlert's Application Server could allow an attacker to write arbitrary files to the system, potentially impacting service availability or integrity when supported by the advisory.

Arbitrary file writes to the server.
Unauthenticated network access.
Service disruption or unauthorized modifications.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Directory Traversal vulnerability in the Desktop Alert PingAlert Application Server likely requires coordination between the application owners who manage the PingAlert instances and the infrastructure or platform teams responsible for the underlying servers and network access. The first practical step involves identifying all PingAlert deployments, confirming their exposure and criticality, and then assigning an accountable owner to plan the necessary remediation.

Application owners should prioritize remediation.
Verify affected PingAlert server exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Desktop Alert PingAlert?

PingAlert is an application server component used for critical mass notification and alerting. It acts as a central hub for organizational communication, managing messaging workflows and dispatching alerts to various endpoints. Because it handles sensitive communication flows, it is typically deployed within infrastructure to facilitate real-time connectivity across an enterprise.

What does CVE-2025-54347 mean?

This CVE refers to a Directory Traversal weakness, classified as CWE-22. In plain terms, the software fails to properly sanitize input, allowing an attacker to navigate outside the intended folder structure. By manipulating file paths, an unauthorized user can force the application to save files to locations they should not have access to, potentially overwriting critical system files.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the PingAlert Application Server. The request must include malicious path sequences that trick the server into writing data to an arbitrary location. This bug is not triggered by standard, legitimate administrative use of the software's management interface or routine messaging traffic.

Is my PingAlert instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your application server is reachable over the network, as is common for alerting infrastructure. Since the attack vector is network-based, servers that are internet-facing or accessible via broad internal network segments are more likely to be reachable by an attacker attempting to exploit this flaw.

How do I respond to this threat?

The first step is to perform an inventory of all PingAlert deployments in your environment to identify versions 6.1.0.11 through 6.1.1.2. Once identified, work with your infrastructure and application teams to evaluate the server's network exposure. Prioritize restricting access to these servers while planning for the necessary software updates to remediate the vulnerability.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.