Wolfram Cloud 14.2 Java Virtual Machine /tmp/ privilege escalation

Summaryinfo

A vulnerability identified as problematic has been detected in Wolfram Cloud 14.2. Impacted is an unknown function of the file /tmp/ of the component Java Virtual Machine. The manipulation leads to Remote Privilege Escalation. This vulnerability is uniquely identified as CVE-2025-11919. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Wolfram Cloud 14.2. It has been rated as problematic. This issue affects some unknown functionality of the file /tmp/ of the component Java Virtual Machine. The manipulation with an unknown input leads to a remote privilege escalation vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-11919. The exploitation is known to be difficult. The attack may be initiated remotely. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-210362). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Cloud Software

Vendor

• Wolfram

Name

• Cloud

Version

• 14.2

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion