CVE-2025-7107

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7107
A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is recommended to apply a patch to fix this issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a Patch
https://github.com/simstudioai/sim/pull/437 Exploit Patch
https://github.com/vri-report/reports/issues/2 Exploit Issue Tracking Third Party Advisory
https://github.com/vri-report/reports/issues/2#issue-3161840085 Exploit Issue Tracking Release Notes Third Party Advisory
https://vuldb.com/?ctiid.315018 Permissions Required VDB Entry
https://vuldb.com/?id.315018 Third Party Advisory VDB Entry
https://vuldb.com/?submit.601043 Third Party Advisory VDB Entry
https://github.com/vri-report/reports/issues/2 Exploit Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sim:sim:*:*:*:*:*:*:*:*
History

01 Oct 2025, 18:49

Type Values Removed Values Added
References () https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a - () https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a - Patch
References () https://github.com/simstudioai/sim/pull/437 - () https://github.com/simstudioai/sim/pull/437 - Exploit, Patch
References () https://github.com/vri-report/reports/issues/2 - () https://github.com/vri-report/reports/issues/2 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/vri-report/reports/issues/2#issue-3161840085 - () https://github.com/vri-report/reports/issues/2#issue-3161840085 - Exploit, Issue Tracking, Release Notes, Third Party Advisory
References () https://vuldb.com/?ctiid.315018 - () https://vuldb.com/?ctiid.315018 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.315018 - () https://vuldb.com/?id.315018 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.601043 - () https://vuldb.com/?submit.601043 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:sim:sim:*:*:*:*:*:*:*:*
First Time Sim sim
Sim

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) Se ha detectado una vulnerabilidad crítica en SimStudioAI sim (hasta la versión 0.1.17). La función handleLocalFile del archivo apps/sim/app/api/files/parse/route.ts está afectada. La manipulación del argumento filePath provoca un path traversal. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. El parche se identifica como b2450530d1ddd0397a11001a72aa0fde401db16a. Se recomienda aplicar un parche para solucionar este problema.

07 Jul 2025, 16:15

Type Values Removed Values Added
References () https://github.com/vri-report/reports/issues/2 - () https://github.com/vri-report/reports/issues/2 -

07 Jul 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-07 03:15

Updated : 2025-10-01 18:49

NVD link : CVE-2025-7107

Mitre link : CVE-2025-7107

CVE.ORG link : CVE-2025-7107

JSON object : View

Products Affected

sim

  • sim
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')