CVE-2025-7107CWE-22

SimStudioAI sim route.ts handleLocalFile path traversal

Medium · published July 7, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
60.0
In the wild
Unconfirmed
What it is

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is recommended to apply a patch to fix this issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00923 · 60.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-07-07T02:02Z
EPSS history
Timeline
  • 07 JUL 02:02Z
    SimStudioAI sim route.ts handleLocalFile path traversal
    cvelistv5