CVE-2025-9801mediumCWE-22

CVE-2025-9801: medium-severity vulnerability in SimStudioAI sim

SimStudioAI sim path traversal

Published · Updated

Follow this CVE+ Monitor sim

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.8%
A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This affects an unknown part. The manipulation of the argument filePath leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 45372aece5e05e04b417442417416a52e90ba174. To fix this issue, it is recommended to deploy a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
SimStudioAI · sim
Related CVEs — SimStudioAI sim

In the same product, most dangerous first.

CVE-2025-7107MEDIUMSimStudioAI sim route.ts handleLocalFile path traversalEPSS 0.9%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2025-7114MEDIUMSimStudioAI sim Session route.ts POST missing authenticationEPSS 0.6%CVE-2026-3431CRITICALSim Studio AI - MongoDB SSRF and Arbitrary Document DeletionEPSS 0.4%CVE-2026-3432CRITICALSim Studio AI - Unauthenticated OAuth Token TheftEPSS 0.3%CVE-2025-9800MEDIUMSimStudioAI sim HTML File route.ts import unrestricted uploadEPSS 0.3%