Untrusted Search Path Vulnerability in Unity Editor Affects Multiple Platforms
CVE-2025-59489

7.4HIGH

Key Information:

Vendor: Unity3d
Status: Unity Editor
Vendor: CVE Published:; 3 October 2025

Badges

🥇 Trended No. 1📈 Trended📈 Score: 7,140💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2025-59489?

CVE-2025-59489 identifies an untrusted search path vulnerability in the Unity Editor, affecting versions from 2019.1 through 6000.3. Unity Editor, developed by Unity Technologies, is a widely-used platform for creating and deploying interactive 2D and 3D applications across various environments, including games and simulations. This vulnerability arises due to improper handling of file loading and local file inclusion (LFI) mechanisms, which could allow remote attackers to manipulate runtime resources and integrate unauthorized third-party components. Such untrusted paths pose significant risks as they facilitate the execution of arbitrary code within applications built using Unity, impacting not only the software itself but also any integrated systems and data.

Potential Impact of CVE-2025-59489

Unauthorized Access and Manipulation: Exploitation of this vulnerability can lead to unauthorized access, enabling attackers to manipulate the application’s resources. This includes potential alterations to the software’s functionality and access to sensitive data managed by the application.
Local File Inclusion Attacks: By leveraging the local file inclusion mechanisms, attackers may execute malicious scripts or obtain sensitive files from the system where the Unity application is running. This can lead to further exploitation of the environment, potentially allowing for broader network compromise.
Impact Across Multiple Platforms: The vulnerability’s reach extends across various operating systems, including Android, Windows, macOS, and Linux. This cross-platform nature means that a wide array of applications developed with Unity are at risk, heightening the urgency for organizations to address the vulnerability to safeguard their applications and associated data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Unity Editor 6000.3 < 6000.3.0b4

Unity Editor 6000.2 < 6000.2.6f2

Unity Editor 6000.0 LTS < 6000.0.58f2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-59489-POC
Created by GithubKillsMyOpsec

Exploit-CVE-2025-59489
Created by AdriianFdz