CVE-2025-65530
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cloudlinux | ai-bolit | to 32.7.4-1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-95 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect if your system is vulnerable by checking the installed version of the ai-bolit package. For RPM-based systems (CentOS/CloudLinux/AlmaLinux), use the command: `rpm -qa | grep ai-bolit`. For Debian-based systems (Debian/Ubuntu), use: `dpkg -l | grep ai-bolit`. If the version is prior to 32.7.4-1, your system is vulnerable. There is no specific network detection command provided, but monitoring for suspicious file scans or unexpected root file overwrites could be indicative. [1]
Can you explain this vulnerability to me?
This vulnerability is an eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before version 32.7.4. It allows attackers to execute arbitrary code by injecting malicious input into the eval function, which can lead to overwriting arbitrary files with root privileges when scanning a crafted file.
How can this vulnerability impact me? :
The vulnerability can allow attackers to overwrite arbitrary files as root, potentially leading to full system compromise, unauthorized data modification, or disruption of system operations.
What immediate steps should I take to mitigate this vulnerability?
The immediate step is to upgrade the ai-bolit package to version 32.7.4-1 or later using your system's package manager (yum for RPM-based systems, apt-get for Debian-based systems). If upgrading immediately is not possible, temporarily disable all types of file scans including scheduled, real-time, FTP, and ModSecurity uploads by modifying configuration settings to disable malware scanning features and scheduled scans or restrict scans to trusted users only. Automatic updates are strongly recommended as the primary defense. [1]