CVE-2025-35055 Newforma Info Exchange (NIX) insecure file upload

High 8.7 Published 9 Oct 2025 Updated 10 Oct 2025

Authenticated attackers can upload arbitrary files to execute code or delete directories in Newforma Info Exchange, with anonymous access exacerbating the risk.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-35055?

CVE-2025-35055 is a high-severity vulnerability in Newforma Project Center, published on 9 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web server. An attacker can also delete directories. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability.

Weakness: CWE-434, CWE-22

Which versions are affected by CVE-2025-35055?

It affects 1 product.

Products include Newforma Project Center.

How do I fix CVE-2025-35055?

No fix has been published for CVE-2025-35055 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-35055 being exploited?

There is no known exploitation of CVE-2025-35055 in the wild and no public exploit code.

Sources

Also known as GHSA-pv37-mf6h-p9j8.