EUVD-2025-209206
GHSA-q6cm-wqcq-7q3c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
AnalysisAI
Directory traversal in BizTalk360 before version 11.5 allows authenticated attackers to write files outside the intended upload directory and potentially coerce authentication from the service through mishandling of user input in an upload mechanism. The vulnerability requires valid authentication credentials but enables arbitrary file write capabilities that could lead to remote code execution or service compromise.
Technical ContextAI
The vulnerability exists in BizTalk360's file upload handling mechanism, which fails to properly validate and sanitize user-supplied path input. This is a classic path traversal (directory traversal) vulnerability where an attacker can use directory traversal sequences (such as ../ or absolute paths) to escape the intended upload directory boundaries. The root cause stems from insufficient input validation on file paths during the upload process, allowing an authenticated user to specify arbitrary file destinations on the underlying system. BizTalk360 is a Microsoft BizTalk Server management and monitoring platform; the vulnerability affects versions prior to 11.5.
RemediationAI
The primary remediation is to upgrade BizTalk360 to version 11.5 or later, which addresses the directory traversal vulnerability. Organizations running versions 11.4 and earlier should prioritize this upgrade. Until patching is possible, restrict file upload functionality to trusted administrators only, implement strict file path validation on the application layer, and review recent file upload activity for suspicious file write patterns outside normal directories. Refer to the Synacktiv advisory at https://www.synacktiv.com/en/advisories/remote-code-execution-from-any-domain-account-in-biztalk360 for additional technical details and confirmation of remediation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today