DreamFactory CVE-2025-13700

Exploitation requires an authenticated, high-privilege session (PR:H) with access to DreamFactory's package export / saveZipFile feature, and the attacker must supply the archive encryption password value - the exact parameter passed unescaped into the shell 'zip -r -P <password>' command built in Package.php. The pre-patch code constructed this command using a command separator (';' on Unix, '&' on Windows) with user-controlled input and no escapeshellarg(), so the injection fires specifically when the password-protected zip export path is triggered. Limiting factors: the attacker needs valid privileged credentials (package management is an administrative capability), the vulnerable shell fallback path executes only when native PHP ZipArchive encryption is unavailable, and impact is bounded to the service account's OS context. No user interaction is required once privileged access is held.

This is a genuine but conditional priority rather than a drop-everything emergency. The provided CVSS 3.0 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes network-reachable, low-complexity code execution with full C/I/A impact, but PR:H means the attacker must already hold high (effectively administrative/privileged) access, which substantially narrows the realistic threat population. EPSS is modest at 1.58% (75th percentile), consistent with a flaw that is credible but not mass-exploited. The vulnerability is NOT in CISA KEV and there is no public exploit code referenced (only a ZDI advisory and the vendor patch commit), so exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent - high technical impact offset by a high privilege barrier - with no contradiction between CVSS, EPSS, and KEV. The main residual risk is privilege escalation/lateral movement: an authenticated administrator (or an attacker who has already compromised such credentials) converting account access into OS-level code execution as the service account. No SSVC decision data was supplied in the input.

An attacker who already holds high-privilege (administrative) access to a DreamFactory instance invokes the package-export/saveZipFile functionality with a crafted password string; because the string is passed into a shell command without proper escaping, the attacker injects additional OS commands that execute as the DreamFactory service account. No public proof-of-concept is referenced, though the ZDI advisory and the patch commit confirm the exploitable code path. Low attack complexity means a valid privileged session is the primary gate to reliable exploitation.