CVE-2025-32671: Arbitrary File Access in Print Science Designer

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and read files from the server's file system. This could expose sensitive data such as configuration files, database credentials, or even source code. Successful exploitation could lead to a significant compromise of the server's confidentiality. While the description doesn't explicitly mention it, a successful attacker could potentially use this vulnerability to gain further access to the system, depending on the files they are able to read and the privileges of the web server process. This is similar to other path traversal vulnerabilities where attackers leverage file disclosure to escalate privileges or gain further system access.

1. Reserved2025-04-09
2. Published2025-04-11
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32671 is to upgrade Print Science Designer to version 1.3.156 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block requests containing path traversal sequences (e.g., ../). Restrict file system access permissions for the web server user to the minimum necessary. Regularly review and audit file system permissions to ensure they are properly configured. After upgrading, confirm the vulnerability is resolved by attempting to access a non-existent file via a path traversal request; the server should return a 403 or 404 error.