CVE-2026-25760: Bishopfox Sliver

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.

Affected products

• Bishopfox Sliver: before 1.6.11 (fixed in 1.6.11)

Published 2026-02-06. Last modified 2026-06-17.