PT-2025-26240 · Upsonic · Upsonic

7Resp4Ss · Published 2025-06-19 · Updated 2025-06-20 · CVE-2025-6278

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Upsonic versions up to 0.55.6

Description A critical vulnerability was found in Upsonic, affecting the os.path.join function in the markdown/server.py file. The manipulation of the file.filename argument leads to path traversal. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 0.55.6, consider restricting access to the os.path.join function in the markdown/server.py file to minimize the risk of exploitation. As a temporary workaround, avoid using the file.filename argument in the affected function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6278

GHSA-8JF4-FCJR-68C2

PYSEC-2025-67

Affected Products

Upsonic

References · 18

• 🔥 https://github.com/Upsonic/Upsonic/issues/356 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6278 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8jf4-fcjr-68c2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-67 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6278 · Security Note
• https://github.com/Upsonic/Upsonic · Note
• https://github.com/Upsonic/Upsonic/pull/360 · Note
• https://github.com/Upsonic/Upsonic/commit/a54529acc6e4bfe28f4f5c80c058144348a306b7 · Note
• https://github.com/Upsonic/Upsonic/blob/v0.55.6/src/upsonic/server/markdown/server/server.py#L39 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/upsonic/PYSEC-2025-67.yaml · Note
• https://twitter.com/VulmonFeeds/status/1935816421704896813 · Twitter Post
• https://twitter.com/transilienceai/status/1935916097636536517 · Twitter Post
• https://twitter.com/CVEnew/status/1935812715387232337 · Twitter Post
• https://vuldb.com/?ctiid.313282 · Note
• https://t.me/cvenotify/126182 · Telegram Post