CVE-2025-12155highCWE-77

CVE-2025-12155: falha de alta gravidade em Google Cloud Looker

Command Injection in Looker

Publicada em

Seguir esta CVE+ Monitorar Looker

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 1.3%
A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.192+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/U:Red
Produtos afetados
Google Cloud · Looker
CVEs relacionadas — Google Cloud Looker

No mesmo produto, das mais perigosas para as menos.

CVE-2026-15810HIGHCross-Site Scripting (XSS) in Looker allows Admin Account TakeoverEPSS 0.5%CVE-2025-12414CRITICALLooker account compromise via punycode homograph attackEPSS 0.4%CVE-2025-12739HIGHCross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account CompromiseEPSS 0.3%CVE-2025-12743MEDIUMSQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL DatabaseEPSS 0.3%CVE-2025-12472HIGHRemote Code Execution in Looker due to Improperly Validated Directory DeletionEPSS 0.3%CVE-2025-12741HIGHArbitrary File Write in Denodo dialect of Looker allows Remote Code ExecutionEPSS 0.3%