CVE-2025-67506
BaseFortify
Publication date: 2025-12-10
Last updated on: 2026-03-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pipeshub | pipeshub | 0.1.0 |
| pipeshub | pipeshub | 0.1.2 |
| pipeshub | pipeshub | 0.1.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in PipesHub versions prior to 0.1.0-beta where the POST /api/v1/record/buffer/convert endpoint lacks authentication. This endpoint accepts file uploads and converts them to PDF using LibreOffice, saving the uploaded file to a temporary directory without normalizing the filename. An attacker can exploit this by submitting a crafted filename containing directory traversal sequences (../) to write arbitrary files anywhere the service account has permission, potentially overwriting files or planting malicious code.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to overwrite arbitrary files on the server or plant malicious code by exploiting the file upload functionality without authentication. This can lead to remote code execution, data compromise, service disruption, or unauthorized access, severely impacting the confidentiality, integrity, and availability of the system.
What immediate steps should I take to mitigate this vulnerability?
Upgrade PipesHub to version 0.1.0-beta or later, as this version fixes the missing authentication issue on the POST /api/v1/record/buffer/convert endpoint. Until the upgrade, restrict access to this endpoint to trusted users only and monitor for any suspicious file uploads that may contain directory traversal sequences (../).
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated remote attackers to write arbitrary files on the server, potentially leading to remote code execution, data integrity compromise, and service disruption. Such security breaches can result in unauthorized access to sensitive data or system resources, violating data protection requirements under standards like GDPR and HIPAA. The high impact on confidentiality, integrity, and availability means organizations using affected versions of PipesHub may fail to meet compliance obligations related to protecting personal or sensitive information, ensuring system integrity, and maintaining service availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthenticated POST requests to the endpoint `/api/v1/record/buffer/convert` that include file uploads with filenames containing path traversal sequences such as `../`. You can use network traffic inspection tools or web server logs to identify such requests. For example, using `grep` on server access logs to find suspicious POST requests: `grep 'POST /api/v1/record/buffer/convert' /var/log/nginx/access.log | grep '\.\./'` or using a network capture tool like `tcpdump` or `Wireshark` to filter HTTP POST requests to that endpoint and inspect filenames in multipart form data. Additionally, scanning the filesystem for unexpected or recently modified files outside the expected temporary directory may help detect exploitation attempts. Since the vulnerability involves path traversal in filenames, commands to search for files with suspicious names or unexpected locations can be useful. However, no specific detection commands are provided in the resources. [1]