Platform
other
Component
sim
Fixed in
9.0.1
CVE-2025-9801 is a Path Traversal vulnerability affecting SimStudioAI sim, specifically versions up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This vulnerability allows attackers to potentially access sensitive files and directories on the system by manipulating the filePath argument. A patch (45372aece5e05e04b417442417416a52e90ba174) is available, and upgrading to version 9.0.1 is recommended.
Successful exploitation of CVE-2025-9801 allows an attacker to bypass intended access controls and read arbitrary files on the system. This could expose sensitive data such as configuration files, source code, or even user credentials. The ability to read arbitrary files could also be a stepping stone for further attacks, potentially leading to code execution or system compromise. Given the disclosed nature of the exploit, the risk of immediate exploitation is elevated.
CVE-2025-9801 has been publicly disclosed, indicating a higher probability of exploitation. The availability of a public exploit further increases the risk. The vulnerability is not currently listed on CISA KEV, but its public nature warrants close monitoring. The CVSS score of 5.4 (MEDIUM) reflects the potential impact and ease of exploitation.
Exploit Status
EPSS
0.07% (22% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-9801 is to apply the provided patch (45372aece5e05e04b417442417416a52e90ba174) or upgrade to version 9.0.1 of SimStudioAI sim. Due to the rolling release nature of the product, direct rollback may not be possible; carefully test the patch in a non-production environment before deploying it to production. Consider implementing input validation on the filePath argument to restrict allowed characters and paths, although this is not a substitute for patching. Monitor system logs for unusual file access patterns.
Apply the patch 45372aece5e05e04b417442417416a52e90ba174 provided by the vendor. This patch corrects the path traversal (Path Traversal) vulnerability. Consult the SimStudioAI documentation for specific instructions on how to apply the patch to your installation.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-9801 is a Path Traversal vulnerability in SimStudioAI sim versions up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af, allowing attackers to access unauthorized files.
If you are using SimStudioAI sim versions prior to 9.0.1 or the patch 45372aece5e05e04b417442417416a52e90ba174, you are potentially affected.
Apply the patch 45372aece5e05e04b417442417416a52e90ba174 or upgrade to version 9.0.1 of SimStudioAI sim.
The vulnerability has been publicly disclosed and a public exploit is available, suggesting a high likelihood of active exploitation.
Refer to the SimStudioAI documentation and release notes for the latest advisory regarding CVE-2025-9801 and the associated patch.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.