CVE-2025-59171

Critical · 9.8

CVSS

9.8

EPSS

0.8%

Published

Nov 6, 2025

CISA due date

—

The record

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

Affected packages

Ecosystem	Package	Introduced	Fixed