CVE-2025-67506 PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload
Unauthenticated attackers can exploit path traversal in file uploads to write arbitrary files, potentially enabling remote code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-67506?
CVE-2025-67506 is a critical path traversal vulnerability in pipeshub-ai, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.
Which versions are affected by CVE-2025-67506?
It affects 1 product.
Products include Pipeshub Pipeshub.
How do I fix CVE-2025-67506?
No fix has been published for CVE-2025-67506 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-67506 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67506 exists.
Sources
Also known as GHSA-w398-9m55-2357.