PT-2025-37160 · Google · Google Secops Soar Server

Jakub Domeracki + 1 · Published 2025-09-11 · Updated 2025-09-13 · CVE-2025-9918

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Google SecOps SOAR Server versions prior to 6.3.54.0

Description: A path traversal flaw exists in the archive extraction component of Google SecOps SOAR Server. This allows an authenticated attacker with Use Case import permissions to achieve Remote Code Execution (RCE) by uploading a malicious ZIP archive containing path traversal sequences.

Recommendations: Update Google SecOps SOAR Server to version 6.3.54.0 or later.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-9918

Affected Products

Google Secops Soar Server

References · 4

• https://cloud.google.com/support/bulletins?gcp-2025-049 · Vendor Advisory
• https://cloud.google.com/chronicle/docs/security-bulletins#GCP-2025-049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9918 · Security Note
• https://twitter.com/SecAideInfo/status/1966807225948598617 · Twitter Post