What is the CVSS score of CVE-2025-70341?

CVE-2025-70341 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of App Auto Patch are affected by CVE-2025-70341?

CVE-2025-70341 in App-Auto-Patch v3.4.2 allows attackers to write arbitrary files to affected systems through a race condition vulnerability.. A patch is available.

Is there a public PoC exploit available for CVE-2025-70341?

Yes, a public proof-of-concept exploit is available for CVE-2025-70341. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-70341?

Within 24 hours: Identify all systems running App-Auto-Patch v3.4.2 and isolate or restrict network access to affected servers. Within 7 days: Apply the available vendor patch to all affected systems, prioritizing production and critical infrastructure. Within 30 days: Conduct a post-incident security review to verify patch deployment completeness and audit logs for signs of exploitation.

App Auto Patch CVE-2025-70341

HIGH

Code Injection (CWE-94)

2026-03-04 cve@mitre.org

Race Condition App Auto Patch

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 18:19 vuln.today

Public exploit code

Patch released

Mar 05, 2026 - 18:19 nvd

Patch available

CVE Published

Mar 04, 2026 - 15:16 nvd

HIGH 7.8

DescriptionCVE.org

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

AnalysisAI

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. [CVSS 7.8 HIGH]

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects App-Auto-Patch. Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.