EUVD-2025-18115
GHSA-266m-wp2v-x7mq
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
AnalysisAI
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote attackers to execute arbitrary code through a network vector, requiring user interaction. The vulnerability affects multiple versions of .NET Framework and Visual Studio across Windows platforms. While the CVSS score is 7.5 (high), the attack complexity is high and requires user interaction, potentially limiting real-world exploitation frequency.
Technical ContextAI
This vulnerability exploits CWE-426 (Untrusted Search Path), a class of issues where applications search for resources (libraries, modules, configuration files) in directories that an attacker can control or manipulate. In the .NET and Visual Studio ecosystem, this typically manifests when the runtime or IDE searches for assemblies, NuGet packages, or supporting libraries in the current working directory or other writable locations before checking system-protected paths. The untrusted search path allows an attacker to place malicious .NET assemblies or components in predictable locations (e.g., project directories, temporary folders, or shared network paths), which are then loaded and executed with the privileges of the user running Visual Studio or the .NET application. The network attack vector (AV:N) suggests this can be triggered remotely, possibly through shared project files, compromised NuGet feeds, or remote filesystem access.
RemediationAI
- Immediate mitigation: Configure Visual Studio and .NET projects to disable assembly search in untrusted directories; review environment PATH variables and remove writable locations from assembly resolution order. 2. Patch deployment: Obtain and deploy the latest security updates from Microsoft for affected .NET Framework versions and Visual Studio releases via Windows Update or the Visual Studio Installer. 3. Access control: Restrict project directories and shared development environments to authenticated users; implement filesystem permissions to prevent unauthorized modification of project folders. 4. Best practices: Validate NuGet package sources and use private package feeds; implement code signing and package integrity verification; avoid opening untrusted or downloaded projects without review. 5. Vendor advisory: Monitor the Microsoft Security Update Guide (portal.msrc.microsoft.com) and subscribe to .NET runtime and Visual Studio release notes for patch availability and timeline. As of the CVE issuance date, a security patch should be available; deploy according to your organizational patch management schedule.
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena
Static ASP.NET machineKey in Calero VeraSMART before 2022 R1. Hardcoded key enables ViewState deserialization attacks an
Same weakness CWE-426 – Untrusted Search Path
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | not-affected | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | ignored | see notes |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | released | 8.0.117-8.0.17-0ubuntu1~22.04.1 |
| noble | released | 8.0.117-8.0.17-0ubuntu1~24.04.1 |
| oracular | released | 8.0.117-8.0.17-0ubuntu1~24.10.1 |
| plucky | released | 8.0.117-8.0.17-0ubuntu1~25.04.1 |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | released | 9.0.107-9.0.6-0ubuntu1~24.10.1 |
| plucky | released | 9.0.107-9.0.6-0ubuntu1~25.04.1 |
| upstream | needs-triage | - |
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today