Read the docs
TI-2025-41262 Aliases CVE-2025-67506

PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload

Priority HIGH 82CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01808 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pipeshub-ai (pipeshub-ai): 0.1.0-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pipeshub-aipipeshub-aibefore 0.1.0-beta0.1.0-betaPatch availableCNA
  • pipeshub-ai Vendorpipeshub-ai Affected before 0.1.0-beta Fixed in 0.1.0-beta Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:pipeshub:pipeshub:0.1.0:alpha:*:*:*:*:*:*0.1.0 alphaVulnerablePipeshub
cpe:2.3:a:pipeshub:pipeshub:0.1.2:alpha:*:*:*:*:*:*0.1.2 alphaVulnerablePipeshub
cpe:2.3:a:pipeshub:pipeshub:0.1.3:alpha:*:*:*:*:*:*0.1.3 alphaVulnerablePipeshub
  • cpe:2.3:a:pipeshub:pipeshub:0.1.0:alpha:*:*:*:*:*:* Versions 0.1.0 alpha Vulnerable ·Pipeshub
  • cpe:2.3:a:pipeshub:pipeshub:0.1.2:alpha:*:*:*:*:*:* Versions 0.1.2 alpha Vulnerable ·Pipeshub
  • cpe:2.3:a:pipeshub:pipeshub:0.1.3:alpha:*:*:*:*:*:* Versions 0.1.3 alpha Vulnerable ·Pipeshub

Remediation

  • Fix · CNA pipeshub-ai (pipeshub-ai) Fixed in 0.1.0-beta

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67506

References

Exploit 1

Patch 1

  • TI-2026-83186 Rate limit bypass in PipesHub via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
  • TI-2026-83185 Event type injection in PipesHub lets users delete connectors CVSS 4.0HIGH 7.1
  • TI-2026-83187 Server-side request forgery in PipesHub via image URLs in documents CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences