{"id":"CVE-2025-67506","title":"PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation","summary":"PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22","CWE-434"],"vendor":"pipeshub","product":"pipeshub","affected":["pipeshub = 0.1.0","pipeshub = 0.1.2","pipeshub = 0.1.3"],"published":"2025-12-10","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67506","references":[{"url":"https://github.com/pipeshub-ai/pipeshub-ai/commit/987ebab40a1fc39956730ed93220f7f9b2c4e5f8","label":"security-advisories@github.com"},{"url":"https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-w398-9m55-2357","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.01808,"epssPercentile":0.78167,"ingestedAt":"2026-10-14T21:57:04.776Z","slug":"CVE-2025-67506","body":"## Overview\n\nPipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.\n\n## Affected\n\n- `pipeshub = 0.1.0`\n- `pipeshub = 0.1.2`\n- `pipeshub = 0.1.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}