Directory Traversal in docuFORM Managed Print Service Client

docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted url.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-65418 is a directory traversal vulnerability (CWE-22) in docuFORM Managed Print Service Client version 11.11c that allows attackers to read arbitrary files by crafting malicious URLs. This vulnerability matters because managed print services are widely deployed across enterprise environments, often with elevated network access and trust levels. Organizations using docuFORM 11.11c are at immediate risk of sensitive data exposure, including configuration files, credentials, and business documents that could be accessed without authentication or with minimal interaction. The affected systems typically handle print job management across multiple departments, making them valuable targets for reconnaissance and lateral movement.

Casky's 331 mapped security skills detect the attack patterns underlying this vulnerability by analyzing reconnaissance (TA0001) and discovery (TA0007) behaviors that precede exploitation. Practitioners using Casky will identify suspicious URL patterns containing path traversal sequences (../, ..\, encoded variants), abnormal file access requests to the docuFORM service endpoints, and attempts to enumerate system directories through crafted requests. Claude's extended reasoning capabilities correlate these HTTP request anomalies with known CWE-22 exploitation signatures, flagging attempts to access sensitive paths like /etc/passwd, Windows registry hives, or application configuration directories. Security teams will see detailed findings showing the relationship between initial reconnaissance probing and successful file access attempts, enabling them to distinguish legitimate print service traffic from exploitation activities targeting this specific vulnerability.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-65418.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2025-65418

Casky has 331 skills that investigate the attack patterns behind CVE-2025-65418. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn