Home Support Security

Relative Path Traversal Vulnerability in NI System Web Server

Updated Dec 11, 2025

Overview

There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.  Successful exploitation requires an attacker to send a specially crafted request to the NI System Web Server, allowing the attacker to read arbitrary files.  This vulnerability existed in NI System Web Server 2012 and prior versions.  It was fixed in 2013.  

 

This vulnerability is identified as CVE-2025-12097.

 

The NI System Web Server is a component installed with several NI products, including LabVIEW.

Contents

Mitigation Guidance

NI strongly recommends upgrading the affected software to mitigate these vulnerabilities.  Refer to the Affected Products section for information on upgrading these products.  

In addition, NI offers the following general defense-in-depth recommendations:

  • Avoid exposing systems directly to the Internet
  • Place network connected systems behind a firewall or implement other compensating controls 
  • When remote access is required, use a secure access method such as a virtual private network (VPN).
Back to top

Affected Products

 

Back to top

CVSS Score

Back to top

Further Information

At NI, we view the security of our products as an important part of our commitment to our customers.  Go to ni.com/security to stay informed and act upon security alerts and issues.

Back to top

Additional Resources

Back to top
Product VersionMitigation
LabVIEW 2009-2012Upgrade to LabVIEW 2013 or later in NI Package Manager or from Software Downloads

Was this information helpful?

Yes

No