CVE-2026-25925

HIGH

PowerDocu < 2.4.0 - Remote Code Execution via Untrusted JSON Deserialization

Title source: llm

Description

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to instantiate arbitrary .NET objects and execute code. This vulnerability is fixed in 2.4.0.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/modery/PowerDocu/security/advisories/GHSA-m8j2-5jr7-2jpw

Release Notes x_refsource_misc

https://github.com/modery/PowerDocu/releases/tag/v-2.4.0

Scores

CVSS v3 7.8

EPSS 0.0027

EPSS Percentile 18.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-502

Status published

Products (1)

modery/powerdocu < 2.4.0

Published Feb 09, 2026

Tracked Since Feb 18, 2026