SimStudioAI sim up to 0.1.17 route.ts handleLocalFile filePath path traversal

Summaryinfo

A vulnerability was found in SimStudioAI sim up to 0.1.17 and classified as critical. Affected by this vulnerability is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath results in path traversal. This vulnerability was named CVE-2025-7107. The attack may be performed from remote. In addition, an exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality.

The advisory is available at github.com. This vulnerability is traded as CVE-2025-7107. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Applying the patch b2450530d1ddd0397a11001a72aa0fde401db16a is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-20175). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• SimStudioAI

Name

• sim

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4
• 0.1.5
• 0.1.6
• 0.1.7
• 0.1.8
• 0.1.9
• 0.1.10
• 0.1.11
• 0.1.12
• 0.1.13
• 0.1.14
• 0.1.15
• 0.1.16
• 0.1.17

License

• open-source

Website

• Product: https://github.com/simstudioai/sim/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #601043: SimStudioAI Sim <=0.1.17 Absolute Path Traversal (by github.com)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion