PT-2025-24906 · Microsoft+8 · Net+9
Jony_Juice
·
Published
2025-06-10
·
Updated
2025-12-16
·
CVE-2025-30399
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
.NET versions prior to 8.0.17
.NET versions prior to 9.0.6
Description
A remote code execution vulnerability exists in .NET 8.0 and 9.0 due to improper validation of search paths in Microsoft.NETCore.App.Runtime. An attacker could exploit this vulnerability by placing malicious files in specific locations, leading to unintended code execution.
Recommendations
To fix the vulnerability, update your system to the following package versions:
- .NET SDK 8.0 to version 8.0.117 or later
- .NET Runtime 8.0 to version 8.0.17 or later
- .NET SDK 9.0 to version 9.0.107 or later
- .NET Runtime 9.0 to version 9.0.6 or later Additionally, if you have deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
Fix
RCE
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Net
Red Hat
Red Os
Rocky Linux
Ubuntu
Visual Studio