Read the docs
TI-2025-24574 Aliases CVE-2025-35056GHSA-7cq8-vqmc-75p3

Newforma Info Exchange (NIX) limited file read

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the ability of StreamStampImage to process the file. The encrypted file path can be generated using the shared, hard-coded secret key described in CVE-2025-35052. This vulnerability cannot be exploited as an 'anonymous' user as described in CVE-2025-35062.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix Fixed Project Center (Newforma): 2024.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NewformaProject Centerbefore 2024.12024.1Patch availableCNA
  • Project Center VendorNewforma Affected before 2024.1 Fixed in 2024.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*before 2024.1VulnerableNewforma
  • cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:* Versions before 2024.1 Vulnerable ·Newforma

Remediation

  • Fix · CNA Project Center (Newforma) Fixed in 2024.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Newforma Project Center 2024.1

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-24577 Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspxPriority LOW 29
    • TI-2025-24578 Newforma Info Exchange (NIX) stored XSS via SVG file uploadPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-35056
  2. 2026-10-03 Alias added: GHSA-7cq8-vqmc-75p3

References

Advisory 3

  • TI-2025-24580 Newforma Info Exchange (NIX) default anonymous access CVSS 4.0MEDIUM 6.9
  • TI-2025-24568 Newforma Info Exchange (NIX) .NET unauthenticated deserialization CVSS 4.0CRITICAL 9.3
  • TI-2024-21387 Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. CVSS 3.1CRITICAL 9.8
  • TI-2025-24573 Newforma Info Exchange (NIX) insecure file upload CVSS 4.0HIGH 8.7
  • TI-2025-24569 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization CVSS 4.0HIGH 7.7
  • TI-2025-24579 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx CVSS 4.0HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences