PT-2025-41472 · Newforma · Newforma Info Exchange

Adam Merrill + 6 · Published 2025-10-09 · Updated 2025-10-10 · CVE-2025-35056

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Newforma Info Exchange (NIX) (affected versions not specified)

Description The software contains a flaw in the '/UserWeb/Common/MarkupServices.ashx' endpoint, specifically within the StreamStampImage function. This function processes encrypted file paths and returns an image of the specified file. An attacker can potentially read files by providing an encrypted path. The StreamStampImage function is vulnerable to unauthorized file access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-35056

Affected Products

Newforma Info Exchange

References · 7

• https://osv.dev/vulnerability/CVE-2025-35056 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-35062 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-35056 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-35056 · Security Note
• https://twitter.com/VulmonFeeds/status/1976550937603846220 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · Note
• https://twitter.com/CVEnew/status/1976389907925831812 · Twitter Post