PT-2025-41471 · Newforma · Newforma Info Exchange

Adam Merrill + 6 · Published 2025-10-09 · Updated 2025-10-10 · CVE-2025-35055

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Newforma Info Exchange (NIX) versions prior to 2023.1

Description Newforma Info Exchange (NIX) contains a flaw in the /UserWeb/Common/UploadBlueimp.ashx API endpoint that allows an authenticated attacker to upload arbitrary files to any location writable by the NIX application. This can lead to the execution of a web shell or other executable content by the web server, as well as the deletion of directories. In versions prior to 2023.1, anonymous access is enabled by default, allowing unauthenticated attackers to exploit this file upload issue by effectively authenticating as 'anonymous'. The vulnerable parameter is not specified.

Recommendations Versions prior to 2023.1 should be updated to version 2023.1 or later.

Fix

RCE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2025-35055

Affected Products

Newforma Info Exchange

References · 9

• https://cve.org/CVERecord?id=CVE-2025-35055 · Security Note
• https://osv.dev/vulnerability/CVE-2025-35055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-35055 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-35062 · Security Note
• https://twitter.com/CVEnew/status/1976389909100306593 · Twitter Post
• https://twitter.com/CveFindCom/status/1976387107540050234 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1976553497509171522 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · Note
• https://twitter.com/CveTodo/status/1976402315503435903 · Twitter Post