CVE-2025-55013 Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code
A malicious server can force the Assemblyline 4 Service Client to write files to arbitrary locations via path traversal, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55013?
CVE-2025-55013 is a medium-severity path traversal vulnerability in CybercentreCanada assemblyline, published on 9 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138.
Weakness: CWE-23
Which versions are affected by CVE-2025-55013?
5 open source packages ship an affected version, including assemblyline-service-client.
| Package | Affected | Fixed in |
|---|---|---|
assemblyline-service-client PyPI | All versions | 4.6.0.stable11, 4.6.1.dev138 |
assemblyline-service-client PyPI | All versions | 4.6.0.stable11 |
assemblyline-service-client PyPI | All versions | 4.6.0.stable11 |
assemblyline-service-client PyPI | From 4.6.1.dev0 | 4.6.1.dev138 |
assemblyline-service-client PyPI | From 4.6.1.dev0 | 4.6.1.dev138 |
How do I fix CVE-2025-55013?
Upgrade assemblyline-service-client to a fixed version for your release line: 4.6.0.stable11 or 4.6.1.dev138.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-55013 being exploited?
There is no known exploitation of CVE-2025-55013 in the wild and no public exploit code.
Sources
Also known as GHSA-75jv-vfxf-3865, PYSEC-2026-1194.