PT-2025-17962 · Unknown+1 · Formidable+1

Tunnckocore · Published 2025-04-26 · Updated 2025-12-24 · CVE-2025-46653

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Formidable versions 2.1.0 through 3.x before 3.5.3

Description The issue relies on hexoid to prevent guessing of filenames for untrusted executable content. However, hexoid is documented as not cryptographically secure. There is a scenario in which only the last two characters of a hexoid string need to be guessed.

Recommendations For versions 2.1.0 through 3.x before 3.5.3, update to version 3.5.3 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-46653

GHSA-75V8-2H7P-7M2M

Affected Products

Debian

Formidable

References · 22

• 🔥 https://github.com/zast-ai/vulnerability-reports/blob/main/formidable/file_upload/report.md · Exploit
• https://github.com/node-formidable/formidable/commit/022c2c5577dfe14d2947f10909d81b03b6070bf5 · Patch
• https://osv.dev/vulnerability/CVE-2025-46653 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-46653 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46653 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-46653 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-46653 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46653 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46653 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46653 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75v8-2h7p-7m2m · Vendor Advisory
• https://github.com/node-formidable/formidable/blob/d0fbec13edc8add54a1afb9ce1a8d3db803f8d47/CHANGELOG.md?plain=1#L10 · Note
• https://github.com/node-formidable/formidable/commit/37a3e89fca1ed68ec674a539f13aafd62221ddaa · Note
• https://github.com/node-formidable/formidable · Note
• https://t.me/cvenotify/119919 · Telegram Post