CVE-2025-3722

CVE-2025-3722 is a path traversal vulnerability affecting Trellix System Information Reporter (SIR) versions 1.0.3 and prior. An authenticated, high-privileged user can exploit this flaw by sending malicious ePO post requests to SIR. This allows for the creation or overwriting of files anywhere on the filesystem, potentially leading to sensitive information disclosure. The vulnerability has a CVSS score of 4.4 (Medium), indicating a local attack vector with low attack complexity, requiring high privileges, and resulting in high confidentiality impact. There is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.