Platform
python
Component
pipeshub-ai/pipeshub-ai
Fixed in
0.1.1
CVE-2025-67506 describes a critical Path Traversal vulnerability affecting PipesHub versions prior to 0.1.0-beta. This vulnerability allows attackers to overwrite arbitrary files on the system, potentially leading to remote code execution and compromising the integrity of the workplace AI platform. The vulnerability is present in the /api/v1/record/buffer/convert endpoint due to insufficient authentication and improper filename normalization during file uploads. A fix is available in version 0.1.0-beta.
The impact of CVE-2025-67506 is severe. An attacker can exploit this vulnerability to overwrite critical system files, including configuration files, executables, or even inject malicious code. This could lead to complete system compromise, data exfiltration, or denial of service. The ability to write arbitrary files grants significant control over the affected PipesHub instance and potentially the underlying infrastructure. Successful exploitation could allow an attacker to gain persistent access and pivot to other systems within the network, especially if the PipesHub service account has elevated privileges. This vulnerability shares similarities with other file upload vulnerabilities where improper filename sanitization allows for path manipulation.
CVE-2025-67506 was publicly disclosed on 2025-12-10. The vulnerability’s criticality (CVSS 9.8) suggests a high probability of exploitation. No public proof-of-concept (PoC) code has been released as of this writing, but the ease of exploitation makes it a likely target for opportunistic attackers. It is not currently listed on the CISA KEV catalog. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns targeting PipesHub.
Exploit Status
EPSS
0.22% (44% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-67506 is to immediately upgrade PipesHub to version 0.1.0-beta or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/v1/record/buffer/convert endpoint using a Web Application Firewall (WAF) or proxy to block requests with suspicious filenames containing ../ sequences. Implement strict filename validation and sanitization on the server-side to prevent path traversal attempts. Review and restrict the permissions of the PipesHub service account to minimize the potential impact of a successful file overwrite. After upgrading, confirm the fix by attempting a file upload with a crafted filename containing ../ sequences; the upload should be rejected.
Actualice PipesHub a la versión 0.1.0-beta o posterior. Esta versión corrige la vulnerabilidad de path traversal al validar correctamente los nombres de archivo antes de guardarlos. Alternativamente, implemente una validación robusta de los nombres de archivo en su propia implementación para evitar la escritura de archivos arbitrarios.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-67506 is a critical Path Traversal vulnerability in PipesHub versions before 0.1.0-beta. It allows attackers to overwrite files by manipulating filenames, potentially leading to remote code execution.
You are affected if you are using PipesHub versions prior to 0.1.0-beta. Immediately assess your environment to determine if you are vulnerable.
Upgrade PipesHub to version 0.1.0-beta or later. If immediate upgrade is not possible, implement WAF rules and filename validation as temporary mitigations.
While no public exploits are currently known, the vulnerability's criticality suggests a high probability of exploitation. Monitor threat intelligence feeds for updates.
Refer to the PipesHub official security advisory for detailed information and updates regarding CVE-2025-67506.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.