CVE-2025-67506

🗓️ 10 Dec 2025 00:36:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

PipesHub before 0.1.0-beta allows unauthenticated file upload path traversal.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-67506	10 Dec 202503:30	–	circl
CNNVD	pipeshub-ai 代码问题漏洞	10 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-67506 PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload	10 Dec 202500:36	–	cvelist
EUVD	EUVD-2025-202360	10 Dec 202500:36	–	euvd
NVD	CVE-2025-67506	10 Dec 202501:15	–	nvd
OSV	CVE-2025-67506 PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload	10 Dec 202500:36	–	osv
Positive Technologies	PT-2025-50297	10 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-67506	11 Dec 202500:58	–	redhatcve
Vulnrichment	CVE-2025-67506 PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload	10 Dec 202500:36	–	vulnrichment

NVD

Vulners

Node

pipeshub pipeshubMatch0.1.0alpha

pipeshub pipeshubMatch0.1.2alpha

pipeshub pipeshubMatch0.1.3alpha

[
  {
    "vendor": "pipeshub-ai",
    "product": "pipeshub-ai",
    "versions": [
      {
        "version": "< 0.1.0-beta",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/pipeshub-ai/pipeshub-ai/commit/987ebab40a1fc39956730ed93220f7f9b2c4e5f8
github	www.github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-w398-9m55-2357

Parameter	Position	Path	Description	CWE
file	request body	/api/v1/record/buffer/convert	POST endpoint accepts file upload and uses the filename to write to a temporary path without normalization, enabling path traversal and arbitrary file overwrite via crafted filenames.	CWE-434, CWE-22

17 Mar 2026 20:31Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.00383

SSVC