CVE-2025-62498 AutomationDirect Productivity Suite Relative Path Traversal
An attacker can execute arbitrary code by tampering with a productivity project file opened in AutomationDirect Productivity Suite.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62498?
CVE-2025-62498 is a high-severity path traversal vulnerability in AutomationDirect Productivity 1000 P1-540 CPU, published on 23 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version
4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrary code on the machine where the project is opened.
Weakness: CWE-23
Which versions are affected by CVE-2025-62498?
How do I fix CVE-2025-62498?
No fix has been published for CVE-2025-62498 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-62498 being exploited?
There is no known exploitation of CVE-2025-62498 in the wild and no public exploit code.
Sources
Also known as GHSA-xc8g-qwx7-gcfr.