PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload

The impact of CVE-2025-67506 is severe. An attacker can exploit this vulnerability to overwrite critical system files, including configuration files, executables, or even inject malicious code. This could lead to complete system compromise, data exfiltration, or denial of service. The ability to write arbitrary files grants significant control over the affected PipesHub instance and potentially the underlying infrastructure. Successful exploitation could allow an attacker to gain persistent access and pivot to other systems within the network, especially if the PipesHub service account has elevated privileges. This vulnerability shares similarities with other file upload vulnerabilities where improper filename sanitization allows for path manipulation.

Organizations utilizing PipesHub for enterprise search and workflow automation are at risk, particularly those running versions prior to 0.1.0-beta. Environments where PipesHub is deployed with elevated privileges or integrated with other critical systems are at higher risk. Shared hosting environments where multiple users share the same PipesHub instance are also vulnerable.

• python / server: Monitor system logs for unusual file creation or modification events, particularly in temporary directories. Use find /tmp -type f -mmin -60 to identify recently modified files.

find /tmp -type f -mmin -60 -print0 | xargs -0 ls -l

• generic web: Monitor access logs for requests to /api/v1/record/buffer/convert with filenames containing ../ sequences.

grep 'filename=.*\/\/' /var/log/apache2/access.log

1. 2025-12-10Disclosure

   disclosure

2. 2025-12-10Patch

   patch

1. Gereserveerd2025-12-08
2. Gepubliceerd2025-12-10
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-67506 is to immediately upgrade PipesHub to version 0.1.0-beta or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/v1/record/buffer/convert endpoint using a Web Application Firewall (WAF) or proxy to block requests with suspicious filenames containing ../ sequences. Implement strict filename validation and sanitization on the server-side to prevent path traversal attempts. Review and restrict the permissions of the PipesHub service account to minimize the potential impact of a successful file overwrite. After upgrading, confirm the fix by attempting a file upload with a crafted filename containing ../ sequences; the upload should be rejected.