Created
January 11, 2026 17:19
-
-
Save ZeroBreach-GmbH/00ea6cce1299e1d999b5d1faac4248f1 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ##### Description | |
| The update mechanism in Automai Director improperly validates or restricts update sources and content, allowing an attacker to inject and execute arbitrary system commands during the update process. | |
| ##### Details | |
| * **Product:** Automai Director | |
| * **Affected Versions: < 25.2.0** | |
| * **Vulnerability Type:** CWE-434: Unrestricted Upload of File with Dangerous Type | |
| * **Risk Level:** Critical - CVSS 3.1: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) | |
| * **Authentication:** Required | |
| * **Vendor URL:** | |
| * **Vendor acknowledged vulnerability:** Yes | |
| * **Vendor Status:** Fixed | |
| * **CVE:** CVE-2025-46068 | |
| ##### Impact | |
| A successful exploit enables attackers to run arbitrary commands potentially leading to full system compromise, data manipulation, or deployment of persistent malware. | |
| ##### References | |
| * [National Vulnerability Database CVE-2025-46068](https://nvd.nist.gov/vuln/detail/CVE-2025-46068) | |
| ##### Timeline | |
| * **2025-04:** Vulnerability reported to the vendor. | |
| * **2025-05:** Vendor published a fix for the issue. | |
| * **2026-01:** Information about the vulnerability is published. | |
| ##### Credits | |
| * Bastian Recktenwald |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment