File Upload Vulnerability in PipesHub AI Platform
CVE-2025-67506

9.8CRITICAL

Key Information:

Vendor

Pipeshub-ai

Status
Pipeshub-ai
Vendor
CVE Published:
10 December 2025

What is CVE-2025-67506?

The PipesHub AI Platform has a file upload vulnerability due to missing authentication on the POST /api/v1/record/buffer/convert endpoint. This flaw allows attackers to send specially crafted filenames that exploit the lack of filename normalization, leading to potential arbitrary file writes within the filesystem. An attacker could use this exploitation to overwrite existing files or inject malicious code. Users are urged to update to version 0.1.0-beta to mitigate this security issue.

Affected Version(s)

pipeshub-ai < 0.1.0-beta

References

https://github.com/pipeshub-ai/pipeshub-ai/security/advis...
x_refsource_CONFIRM
https://github.com/pipeshub-ai/pipeshub-ai/commit/987ebab...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.