CVE-2025-7107

MEDIUM

SimStudioAI sim < 0.1.17 - Path Traversal via handleLocalFile Function

Title source: llm
STIX 2.1

Description

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is recommended to apply a patch to fix this issue.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.315018
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.315018
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.601043
Exploit, Issue Tracking, Third Party Advisory issue-tracking
https://github.com/vri-report/reports/issues/2
Exploit, Patch issue-tracking
https://github.com/simstudioai/sim/pull/437
Exploit, Issue Tracking, Release Notes, Third Party Advisory exploit issue-tracking
https://github.com/vri-report/reports/issues/2#issue-3161840085

Scores

CVSS v3 5.3
EPSS 0.0076
EPSS Percentile 50.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
sim/sim < 0.1.17
Published Jul 07, 2025
Tracked Since Feb 18, 2026