# CyberArk Conjur path traversal and file disclosure

Source: https://startwithidentity.com/cves/cve-2025-49830/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

Conjur failed to normalize a path and would read files outside the intended directory. CVSS 7.1. In the Cyata chain it is how you turn an authenticator bypass into host secrets and configuration. Fixed with the rest of the set in 1.22.1 / 13.6.1.

## Why it matters

File disclosure on a secrets manager is rarely "just a file." It is the policy file, the authenticator config, and sometimes the very credentials the manager uses to talk to the cloud.

## What to do

- Upgrade. Do not try to mitigate with a reverse-proxy rewrite.
- After the patch, check that Conjur's working directory does not contain leftover dumps or world-readable policy checkouts.

## After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

- **Rotate everything in scope**, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- **Revoke active leases and tokens**, then review the audit device log for reads you cannot attribute to a known workload.
- **Rotate the vault's own credentials**: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- **Rotate downstream credentials the vault brokered**, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/) and [what is secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/).

## Sources

- [NVD: CVE-2025-49830](https://nvd.nist.gov/vuln/detail/CVE-2025-49830)