CVE-2025-67506
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation.
Published Dec 10, 2025 · updated Oct 14, 2026 · pipeshub pipeshub
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.
Timeline
Detection, updates, and resolution for this record.
Dec 10, 2025 · NIST NVD
Detected
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a craf
Oct 14, 2026 · NIST NVD
Updated
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a craf
Affected
- cpe pipeshub/pipeshub0.1.0
- cpe pipeshub/pipeshub0.1.2
- cpe pipeshub/pipeshub0.1.3
Sources
- CVE.orgCVE-2025-67506
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-67506
30-day exploitation probability 1.8%
first.org - NIST NVDCVE-2025-67506
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by
nvd.nist.gov