CVE-2025-7107

MEDIUM EPSS 50.7%
Published Jul 7, 202511mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 4.0
Medium
Find Similar
Published Jul 7, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is recommended to apply a patch to fix this issue.

CVSS Details

Base Score
5.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
50.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
simsim* ≤0.1.17

References 7

  • github.com https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a
    Patch
  • github.com https://github.com/simstudioai/sim/pull/437
    ExploitPatch
  • github.com https://github.com/vri-report/reports/issues/2
    ExploitIssue TrackingThird Party Advisory
  • github.com https://github.com/vri-report/reports/issues/2#issue-3161840085
    ExploitIssue TrackingRelease NotesThird Party Advisory
  • vuldb.com https://vuldb.com/?ctiid.315018
    Permissions RequiredVDB Entry
  • vuldb.com https://vuldb.com/?id.315018
    Third Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.601043
    Third Party AdvisoryVDB Entry

Remediation

  • github.com https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a
    Patch
  • github.com https://github.com/simstudioai/sim/pull/437
    ExploitPatch