Unprotected temporary directories in Wolfram Cloud may result in privilege escalation
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wolfram Research Inc. | Cloud | 14.2 | — | No fix listed | CNA |
- Cloud VendorWolfram Research Inc. Affected 14.2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11919
- 2026-10-03 Alias added: GHSA-6f68-j9jr-9q2w
References
More Wolfram Research Inc. vulnerabilities
- TI-2001-01013 The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to… CVSS 2.0HIGH 7.5
- TI-2002-00899 Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1… CVSS 2.0MEDIUM 5.0
- TI-2001-01012 The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to cause… CVSS 2.0MEDIUM 5.0
- TI-2010-01943 Mathematica 7, when running on Linux, allows local users to overwrite arbitrary files via… CVSS 2.0LOW 1.9
Sources
- CVE-2025-11919 · CVE Program
- CVE-2025-11919 · NVD
- FIRST EPSS
- GHSA-6f68-j9jr-9q2w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences