File Upload Vulnerability in Newforma Info Exchange Application
CVE-2025-35055

8.7HIGH

Key Information:

Vendor

Newforma

Status
Project Center
Vendor
CVE Published:
9 October 2025

What is CVE-2025-35055?

Newforma Info Exchange (NIX) contains a file upload vulnerability whereby authenticated attackers can upload arbitrary files to any location accessible by the NIX application. This flaw can lead to the execution of web shells or other executable content on the server. Additionally, in versions before 2023.1, the application defaults to allowing anonymous access, which can be exploited by unauthenticated attackers to gain the same privileges to upload malicious files or delete directories.

Affected Version(s)

Project Center 0 < 2023.1

Project Center 2023.1

References

https://www.cve.org/CVERecord?id=CVE-2025-35062
https://www.cve.org/CVERecord?id=CVE-2025-35055
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
JSON
.
CVE-2025-35055 : File Upload Vulnerability in Newforma Info Exchange Application