CVE-2025-7107

Published: Jul 7, 2025Modified: Oct 1, 2025

5.5

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is recommended to apply a patch to fix this issue.

Affected (1)

Products: Sim: Sim

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sim Sim	Up to 0.1.17

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (8)

https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a

Source: cna@vuldb.com

Patch

https://github.com/simstudioai/sim/pull/437

Source: cna@vuldb.com

ExploitPatch

https://github.com/vri-report/reports/issues/2

Source: cna@vuldb.com

ExploitIssue TrackingThird Party Advisory

https://github.com/vri-report/reports/issues/2#issue-3161840085

Source: cna@vuldb.com

ExploitIssue TrackingRelease NotesThird Party Advisory

https://vuldb.com/?ctiid.315018

Source: cna@vuldb.com

Permissions RequiredVDB Entry

https://vuldb.com/?id.315018

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.601043

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

https://github.com/vri-report/reports/issues/2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.