PT-2025-38226 · Unknown · Cisa Thorium

Published 2025-09-16 · Updated 2026-03-10 · CVE-2025-35430

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions CISA Thorium versions prior to 1.1.2

Description The software does not properly check the paths of files when they are downloaded using the 'download ephemeral' and 'download children' functions. This could allow a remote attacker who is already authenticated to access files they should not be able to, limited by the file system's permissions. The vulnerable functions are download ephemeral and download children.

Recommendations Update to version 1.1.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-03189

CVE-2025-35430

Affected Products

Cisa Thorium

References · 10

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-35430 · Security Note
• https://bdu.fstec.ru/vul/2026-03189 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-35430 · Security Note
• https://osv.dev/vulnerability/CVE-2025-35430 · Vendor Advisory
• https://github.com/cisagov/thorium/releases/tag/1.1.2 · Note
• https://github.com/cisagov/thorium/blob/main/api/src/utils/bounder.rs#L120-L158 · Note
• https://twitter.com/CVEnew/status/1968561243561546097 · Twitter Post
• https://t.me/CVEtracker/32771 · Telegram Post
• https://t.me/true_secator/7979 · Telegram Post