PT-2025-34180 · Cdata · Pi Server

Adhkr · Published 2025-08-20 · Updated 2026-01-27 · CVE-2025-9273

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CData API Server (affected versions not specified)

Description CData API Server installations are susceptible to information disclosure. Remote attackers who have authentication can exploit this issue. The flaw resides in the configuration of MySQL connections, where the product allows the MySQL server to request local files from the MySQL client. This can lead to the disclosure of sensitive information within the context of NETWORK SERVICE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-9273

ZDI-25-852

Affected Products

Pi Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9273 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-852 · Security Note, Vendor Advisory
• https://t.me/CVEtracker/31515 · Telegram Post
• https://twitter.com/CVEnew/status/1962976550015356933 · Twitter Post
• https://t.me/cveNotify/149994 · Telegram Post