CVE-2025-35056CWE-22path-traversal

CVE-2025-35056

Medium · published October 10, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the ability of StreamStampImage to process the file. The encrypted file path can be generated using the shared, hard-coded secret key described in CVE-2025-35052. This vulnerability cannot be exploited as an 'anonymous' user as described in CVE-2025-35062.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-10T01:15Z
Affected products (1)
ProductVersionsFixed in
newforma/project_center< 2024.12024.1
References (3)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-35056 · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-35062 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 09 OCT 20:21Z
    Newforma Info Exchange (NIX) limited file read
    cvelistv5