CVE-2025-9118CWE-22

Dataform Path Traversal

Critical · published August 25, 2025

CVSS v4.0
10.0
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00680 · 51.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-08-25T07:05Z
EPSS history
Timeline
  • 25 AUG 07:05Z
    Dataform Path Traversal
    cvelistv5