CVE-2025-65480 in Unison Client
Summary
by MITRE • 02/11/2026
An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain script conditions are fulfilled, leading to Remote Code Execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/13/2026
The vulnerability identified as CVE-2025-65480 resides within the Pacom Unison Client version 5.13.1, representing a critical security flaw that enables authenticated users to inject malicious scripts into report templates. This vulnerability operates under the principle of cross-site scripting injection combined with server-side template execution, creating a pathway for remote code execution. The flaw specifically manifests when users with valid authentication credentials manipulate report template components, allowing them to embed malicious code that executes under the context of the application server. The security implications are severe as this vulnerability essentially transforms a legitimate administrative function into a vector for arbitrary code execution.
The technical mechanism underlying this vulnerability involves the improper sanitization of user input within the report template processing framework. When authenticated users create or modify report templates, the system fails to adequately validate or escape script content that may be embedded within template variables or conditional statements. This weakness creates a condition where malicious payloads can be stored within the template structure and subsequently executed when specific script conditions are met during report generation or processing. The vulnerability directly maps to CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and CWE-94 - Improper Control of Generation of Code ('Code Injection') within the CWE classification system. The attack surface is expanded by the fact that the execution occurs server-side, meaning that the malicious code runs with the privileges of the application itself rather than merely affecting the client browser.
The operational impact of this vulnerability extends beyond simple code injection, as it provides attackers with the capability to execute arbitrary commands on the affected system. An authenticated attacker can leverage this flaw to gain full control over the application server, potentially leading to data exfiltration, privilege escalation, or the establishment of persistent backdoors. The vulnerability affects organizations that rely on Pacom Unison Client for reporting and monitoring functions, particularly those with multiple authenticated users who have access to template modification capabilities. The execution of malicious code can result in complete system compromise, data loss, and potential lateral movement within the network infrastructure. This vulnerability aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: PowerShell within the MITRE ATT&CK framework, as the malicious code execution can leverage scripting capabilities to perform system-level operations.
Mitigation strategies for CVE-2025-65480 should focus on immediate implementation of input validation and sanitization measures within the report template processing components. Organizations should enforce strict content filtering and escape all user-supplied data before it is processed or stored within template structures. The implementation of a robust web application firewall and security monitoring systems can help detect anomalous script execution patterns. Additionally, privilege separation should be enforced to ensure that users with template modification capabilities cannot inject code that executes with elevated privileges. Regular security updates and patches from the vendor should be applied immediately upon availability, while organizations should also consider implementing automated scanning tools to identify and remediate similar vulnerabilities across their infrastructure. The vulnerability highlights the critical importance of secure template processing and input validation in enterprise reporting systems, particularly those handling sensitive data and requiring extensive customization capabilities.