Which versions of Upsonic are affected by CVE-2025-6278?

Organizations using Upsonic should be aware of moderate risk from CVE-2025-6278, a path traversal vulnerability rated CVSS 5.5. This could allow unauthorized file access.. A patch is available.

Is there a public PoC exploit available for CVE-2025-6278?

Yes, a public proof-of-concept exploit is available for CVE-2025-6278. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6278?

Within 30 days: Identify affected systems running Upsonic and apply vendor patches as part of regular patch cycle. Review file handling controls.

Upsonic CVE-2025-6278

Q: What is the CVSS score of CVE-2025-6278?

CVE-2025-6278 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-18698 LOW

Path Traversal (CWE-22)

2025-06-19 cna@vuldb.com

GHSA-8jf4-fcjr-68c2

Path Traversal Upsonic

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Attack vector adjacent, low privileges required, low confidentiality impact.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 13:24 vuln.today

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.5 (MEDIUM) 2.0 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18698

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

PoC Detected

Jul 08, 2025 - 16:38 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 21:15 cve.org

LOW 2.0

CVE Published

Jun 19, 2025 - 21:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used.

AnalysisAI

Path traversal vulnerability in Upsonic up to 0.55.6 allows attackers to read arbitrary files via the file.filename parameter in markdown/server.py. Public exploit code is available, and a patch has been released. The CVSS 4.0 score is 2.0 (low), but the EPSS score of 0.18% suggests low exploitation likelihood.

Technical ContextAI

The vulnerability is a path traversal (CWE-22) in the os.path.join function within markdown/server.py. The affected product is Upsonic, an AI orchestration framework. The CPE cpe:2.3:a:upsonic:upsonic:* indicates all versions are affected. The issue allows an attacker to manipulate the file.filename argument to traverse directories and read arbitrary files on the server.

RemediationAI

Upgrade to the patched version after commit a54529acc6e4bfe28f4f5c80c058144348a306b7 or apply the fix from pull request #360. No workarounds are documented; restricting access to the markdown server endpoint may mitigate risk.