PT-2026-1207 · Milvus · Milvus

0X1F · Publicado 2026-01-05 · Atualizado 2026-01-05 · CVE-2025-15453

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions milvus versions up to 2.6.7

Description A security issue has been identified in milvus. The expr.Exec function within the pkg/util/expr/expr.go file, associated with the HTTP Endpoint component, is susceptible to deserialization due to manipulation of the code argument. Remote exploitation is possible, and the exploit has been publicly disclosed.

Recommendations milvus versions prior to 2.6.8 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-20

CWE-502

Identificadores relacionados

CVE-2025-15453

Produtos afetados

Milvus

Referências · 13

• 🔥 https://github.com/milvus-io/milvus/issues/46442#issue-3743414836 · Exploit
• https://github.com/milvus-io/milvus/issues/46442 · Nota
• https://github.com/milvus-io/milvus/milestone/139 · Nota
• https://github.com/milvus-io/milvus/issues/46442#issuecomment-3672197450 · Nota
• https://osv.dev/vulnerability/CVE-2025-15453 · Aviso do Fabricante
• https://t.me/CVEtracker/41342 · Publicação no Telegram
• https://vuldb.com/?submit.719061 · Nota
• https://twitter.com/VulmonFeeds/status/2008026063293526068 · Publicação no Twitter
• https://vuldb.com/?ctiid.339486 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15453 · Nota de Segurança
• https://twitter.com/CVEnew/status/2008017765211279684 · Publicação no Twitter
• https://vuldb.com/?id.339486 · Nota
• https://t.me/cveNotify/147668 · Publicação no Telegram