CVE-2025-35059 Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx
An unauthenticated attacker can exploit an open redirect in Newforma Info Exchange to redirect users to malicious sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-35059?
CVE-2025-35059 is a medium-severity vulnerability in Newforma Project Center, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter.
Weakness: CWE-601
Which versions are affected by CVE-2025-35059?
It affects 1 product.
Products include Newforma Project Center.
How do I fix CVE-2025-35059?
No fix has been published for CVE-2025-35059 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35059 being exploited?
There is no known exploitation of CVE-2025-35059 in the wild and no public exploit code.
Other vulnerabilities in Newforma Project Center
- CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization
- CVE-2025-35055 Newforma Info Exchange (NIX) insecure file upload
- CVE-2025-35058 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
- CVE-2025-35061 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
- CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
Sources
Also known as GHSA-cgm2-74fx-84hc.