CVE-2025-62353
BaseFortify
Publication date: 2025-10-17
Last updated on: 2025-10-21
Assigner: HiddenLayer
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hiddenlayer | windsurf | * |
| hiddenlayer | windsurf | 1.12.12 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal flaw in all versions of the Windsurf IDE that allows an attacker to read and write arbitrary local files both inside and outside of the current projects on a user's system. It can be exploited directly or through indirect prompt injection.
How can this vulnerability impact me? :
The vulnerability can lead to severe impacts including unauthorized access to sensitive files, modification or deletion of critical data, and potential full system compromise since it allows reading and writing of arbitrary files without any privileges or user interaction.