CVE-2025-0103

An attacker with access to the Expedition application can inject malicious SQL queries (SQL injection, CWE-89) into vulnerable entry points of the application. This grants them the ability to read the contents of the Expedition system database, including password hashes, usernames, network device configurations, and API keys. Additionally, the vulnerability allows for creating and reading arbitrary files in the Expedition server filesystem.

An attacker can seize confidential authentication and configuration data of managed network devices, which consequently may lead to compromise of the entire network infrastructure. The ability to create and read system files additionally expands the attack surface beyond the database itself.

Apply patches available from the vendor according to the references: https://security.paloaltonetworks.com/PAN-SA-2025-0001. Additionally, it is recommended to restrict access to the Expedition interface exclusively to trusted users and administrative networks.

Palo Alto Networks Expedition — versions specified in the vendor references (security.paloaltonetworks.com/PAN-SA-2025-0001)