Loading vulnerability…
CVE-2025-0108 is an authentication bypass vulnerability in the Palo Alto Networks PAN-OS management web interface. The flaw affects PAN-OS and stems from inconsistent processing of incoming requests between the nginx and Apache components that handle management interface traffic. This parsing discrepancy allows a remote, unauthenticated attacker with network access to the management web interface to bypass the normal authentication controls and invoke certain PHP scripts exposed through the interface. The issue does not by itself provide remote code execution, but it enables access to functionality that should be restricted to authenticated administrators. Public reporting also indicates the vulnerability has been used as part of exploit chains with other PAN-OS flaws to deepen compromise of affected firewalls. Cloud NGFW and Prisma Access are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (7 hidden).
This repository provides a proof-of-concept (PoC) and a fixed implementation for CVE-2025-0108, which is a path confusion and header smuggling vulnerability in a multi-layer web stack (Nginx -> Flask backend -> Apache/PHP). The repository is structured into two main directories: one for the vulnerable setup ('CVE-2025-0108_vulnerable') and one for the fixed setup ('CVE-2025-0108_fixed'). Each setup contains Dockerfiles for the backend (Flask) and PHP services, as well as Nginx configuration files and a docker-compose.yml to orchestrate the environment. The vulnerable implementation demonstrates how a double-encoded path in an HTTP request can bypass authentication checks due to inconsistent path decoding between Nginx and the backend Flask application. The exploit is performed by sending a specially crafted HTTP request (using curl) to the Nginx proxy, which forwards it to the backend and ultimately allows access to a protected PHP endpoint. The fixed implementation adds additional path normalization and checks in the backend to prevent this bypass. The repository is intended for educational purposes and includes detailed instructions and test cases in the README.md. The main exploit capability is authentication bypass via path confusion and header smuggling, and the main fingerprintable endpoint is the crafted HTTP URL targeting the Nginx proxy and backend services.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate authentication-bypass vulnerability in PAN-OS software that allows an unauthenticated attacker to invoke certain PHP scripts.
An authentication bypass vulnerability in Palo Alto Networks PAN-OS; added to CISA KEV due to active exploitation.
One of multiple PAN-OS vulnerabilities reported as being chained in real-world attacks to compromise Palo Alto Networks firewalls.
An authentication bypass vulnerability in PAN-OS due to request-parsing inconsistencies, allowing unauthenticated access to firewall management interfaces. Exposed hundreds of thousands of firewalls to attack.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.