Vulnerability-Lookup

CVE-2025-55013 (GCVE-0-2025-55013)

Vulnerability from cvelistv5 – Published: 2025-08-09 02:02 – Updated: 2025-08-12 13:26

Title

Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code

Summary

The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-11 14:07 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7729 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/CybercentreCanada/assemblyline…	x_refsource_CONFIRM
https://github.com/CybercentreCanada/assemblyline…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
CybercentreCanada	assemblyline	Affected: < 4.6.1.dev138	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T14:07:26.606408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T14:07:39.454Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "assemblyline",
          "vendor": "CybercentreCanada",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.1.dev138"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-12T13:26:26.900Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
        },
        {
          "name": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
        }
      ],
      "source": {
        "advisory": "GHSA-75jv-vfxf-3865",
        "discovery": "UNKNOWN"
      },
      "title": "Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55013",
    "datePublished": "2025-08-09T02:02:23.602Z",
    "dateReserved": "2025-08-04T17:34:24.422Z",
    "dateUpdated": "2025-08-12T13:26:26.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-55013",
      "date": "2026-10-18",
      "epss": "0.00584",
      "percentile": "0.46801"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "assemblyline",
                "vendor": "CybercentreCanada",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.6.1.dev138"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138."
          },
          {
            "lang": "es",
            "value": "Assemblyline 4 Service Client interact\u00faa con la API para obtener tareas y publicar el resultado de un servicio en Assemblyline 4. En versiones anteriores a la 4.6.1.dev138, el cliente de servicio de Assemblyline 4 (task_handler.py) acepta un valor SHA-256 devuelto por el servidor de servicio y lo usa directamente como nombre de archivo local. Un servidor malicioso o comprometido (o cualquier MITM que pueda comunicarse con el cliente) puede devolver un payload de path traversal como `../../../etc/cron.d/evil` y obligar al cliente a escribir los bytes descargados en una ubicaci\u00f3n arbitraria del disco. Esto se solucion\u00f3 en la versi\u00f3n 4.6.1.dev138."
          }
        ],
        "id": "CVE-2025-55013",
        "lastModified": "2026-06-17T09:41:06.903",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-55013",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T14:07:26.606408Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-08-09T03:15:47.620",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-23"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-08-11T02:30:35+00:00",
      "cve": "CVE-2025-55013",
      "id": "CVE-2025-55013",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55013.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-55013",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-08-11T14:07:26.606408Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-08-11T14:07:30.497Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "assemblyline",
              "vendor": "CybercentreCanada",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.6.1.dev138"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-23",
                  "description": "CWE-23: Relative Path Traversal",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-08-12T13:26:26.900Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
            },
            {
              "name": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
            }
          ],
          "source": {
            "advisory": "GHSA-75jv-vfxf-3865",
            "discovery": "UNKNOWN"
          },
          "title": "Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-55013",
        "datePublished": "2025-08-09T02:02:23.602Z",
        "dateReserved": "2025-08-04T17:34:24.422Z",
        "dateUpdated": "2025-08-12T13:26:26.900Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-55013

Vulnerability from fkie_nvd - Published: 2025-08-09 03:15 - Updated: 2026-06-17 09:41

Severity

4.2 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900
	security-advisories@github.com	https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "assemblyline",
          "vendor": "CybercentreCanada",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.1.dev138"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138."
    },
    {
      "lang": "es",
      "value": "Assemblyline 4 Service Client interact\u00faa con la API para obtener tareas y publicar el resultado de un servicio en Assemblyline 4. En versiones anteriores a la 4.6.1.dev138, el cliente de servicio de Assemblyline 4 (task_handler.py) acepta un valor SHA-256 devuelto por el servidor de servicio y lo usa directamente como nombre de archivo local. Un servidor malicioso o comprometido (o cualquier MITM que pueda comunicarse con el cliente) puede devolver un payload de path traversal como `../../../etc/cron.d/evil` y obligar al cliente a escribir los bytes descargados en una ubicaci\u00f3n arbitraria del disco. Esto se solucion\u00f3 en la versi\u00f3n 4.6.1.dev138."
    }
  ],
  "id": "CVE-2025-55013",
  "lastModified": "2026-06-17T09:41:06.903",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-55013",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-08-11T14:07:26.606408Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-09T03:15:47.620",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-75JV-VFXF-3865

Vulnerability from github – Published: 2025-07-25 14:15 – Updated: 2025-08-12 13:26

Summary

Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code

Details

Path-Traversal -> Arbitrary File Write in Assemblyline Service Client

IMPORTANT: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as assemblyline-v4-service which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.

See https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.

1. Summary

The Assemblyline 4 service client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.

No validation / sanitisation is performed.

A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as
../../../etc/cron.d/evil
and force the client to write the downloaded bytes to an arbitrary location on disk.

2. Affected Versions

Item	Value
Component	`assemblyline-service-client`
Repository	CybercentreCanada/assemblyline-service-client
Affected	All releases up to master branch.

3. CVSS 3.1 Vector & Score

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4. Technical Details

Field	Content
Location	`assemblyline_service_client/task_handler.py`, inside `download_file()`
Vulnerable Line	`file_path = os.path.join(self.tasking_dir, sha256)`
Root Cause	The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation.
Exploit Flow	1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`. 2. Client writes the response body to `/etc/cron.d/evil`. 3. Achieves arbitrary file write (code execution if file is executable).

5. Impact

Integrity – Overwrite any file writable by the service UID (often root).
Availability – Corrupt critical files or exhaust disk space.
Code Execution – Drop cron jobs, systemd units, or overwrite binaries.

6. Mitigation / Fix

import re

_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\Z')

def download_file(self, sha256: str, sid: str) -> Optional[str]:
    if not _SHA256_RE.fullmatch(sha256):
        self.log.error(f"[{sid}] Invalid SHA256: {sha256}")
        self.status = STATUSES.ERROR_FOUND
        return None
    # or your preferred way to check if a string is a shasum.

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "assemblyline-service-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.0.stable11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "assemblyline-service-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.1.dev0"
            },
            {
              "fixed": "4.6.1.dev138"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55013"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-25T14:15:48Z",
    "nvd_published_at": "2025-08-09T03:15:47Z",
    "severity": "MODERATE"
  },
  "details": "**Path-Traversal -\u003e Arbitrary File Write in Assemblyline Service Client**\n\n**IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.\n\nSee https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.\n\n---\n\n## 1. Summary  \nThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name.  \n\u003e No validation / sanitisation is performed.\n\nA **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as  \n`../../../etc/cron.d/evil`  \nand force the client to write the downloaded bytes to an arbitrary location on disk.\n\n---\n\n## 2. Affected Versions  \n| Item | Value |\n|---|---|\n| **Component** | `assemblyline-service-client` |\n| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |\n| **Affected** | **All releases up to master branch.**  |\n\n\n---\n\n## 3. CVSS 3.1 Vector \u0026 Score  \n```\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\n```\n\n\n---\n\n## 4. Technical Details\n\n| Field | Content |\n|---|---|\n| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |\n| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |\n| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |\n| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.\u003cbr\u003e2. Client writes the response body to `/etc/cron.d/evil`.\u003cbr\u003e3. Achieves arbitrary file write (code execution if file is executable). |\n\n---\n\n## 5. Impact  \n- **Integrity** \u2013 Overwrite any file writable by the service UID (often root).  \n- **Availability** \u2013 Corrupt critical files or exhaust disk space.  \n- **Code Execution** \u2013 Drop cron jobs, systemd units, or overwrite binaries.\n\n---\n\n## 6. Mitigation / Fix\n\n```python\nimport re\n\n_SHA256_RE = re.compile(r\u0027^[0-9a-fA-F]{64}\\Z\u0027)\n\ndef download_file(self, sha256: str, sid: str) -\u003e Optional[str]:\n    if not _SHA256_RE.fullmatch(sha256):\n        self.log.error(f\"[{sid}] Invalid SHA256: {sha256}\")\n        self.status = STATUSES.ERROR_FOUND\n        return None\n    # or your preferred way to check if a string is a shasum.\n```\n---",
  "id": "GHSA-75jv-vfxf-3865",
  "modified": "2025-08-12T13:26:14Z",
  "published": "2025-07-25T14:15:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55013"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/CybercentreCanada/assemblyline-service-client"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code "
}

PYSEC-2026-1194

Vulnerability from pysec - Published: 2026-07-07 16:02 - Updated: 2026-07-07 17:23

Details

Path-Traversal -> Arbitrary File Write in Assemblyline Service Client

See https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.

1. Summary

The Assemblyline 4 service client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.

No validation / sanitisation is performed.

2. Affected Versions

Item	Value
Component	`assemblyline-service-client`
Repository	CybercentreCanada/assemblyline-service-client
Affected	All releases up to master branch.

3. CVSS 3.1 Vector & Score

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4. Technical Details

Field	Content
Location	`assemblyline_service_client/task_handler.py`, inside `download_file()`
Vulnerable Line	`file_path = os.path.join(self.tasking_dir, sha256)`
Root Cause	The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation.
Exploit Flow	1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`. 2. Client writes the response body to `/etc/cron.d/evil`. 3. Achieves arbitrary file write (code execution if file is executable).

5. Impact

Integrity – Overwrite any file writable by the service UID (often root).
Availability – Corrupt critical files or exhaust disk space.
Code Execution – Drop cron jobs, systemd units, or overwrite binaries.

6. Mitigation / Fix

import re

_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\Z')

def download_file(self, sha256: str, sid: str) -> Optional[str]:
    if not _SHA256_RE.fullmatch(sha256):
        self.log.error(f"[{sid}] Invalid SHA256: {sha256}")
        self.status = STATUSES.ERROR_FOUND
        return None
    # or your preferred way to check if a string is a shasum.

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Impacted products

Name	purl
assemblyline-service-client	pkg:pypi/assemblyline-service-client

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "assemblyline-service-client",
        "purl": "pkg:pypi/assemblyline-service-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.0.stable11"
            },
            {
              "introduced": "4.6.1.dev0"
            },
            {
              "fixed": "4.6.1.dev138"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.6.1.dev0",
        "4.6.1.dev1",
        "4.6.1.dev10",
        "4.6.1.dev100",
        "4.6.1.dev101",
        "4.6.1.dev102",
        "4.6.1.dev105",
        "4.6.1.dev106",
        "4.6.1.dev107",
        "4.6.1.dev108",
        "4.6.1.dev109",
        "4.6.1.dev110",
        "4.6.1.dev111",
        "4.6.1.dev112",
        "4.6.1.dev113",
        "4.6.1.dev114",
        "4.6.1.dev115",
        "4.6.1.dev116",
        "4.6.1.dev117",
        "4.6.1.dev119",
        "4.6.1.dev120",
        "4.6.1.dev121",
        "4.6.1.dev122",
        "4.6.1.dev123",
        "4.6.1.dev124",
        "4.6.1.dev125",
        "4.6.1.dev126",
        "4.6.1.dev128",
        "4.6.1.dev129",
        "4.6.1.dev13",
        "4.6.1.dev130",
        "4.6.1.dev131",
        "4.6.1.dev132",
        "4.6.1.dev133",
        "4.6.1.dev134",
        "4.6.1.dev135",
        "4.6.1.dev136",
        "4.6.1.dev137",
        "4.6.1.dev15",
        "4.6.1.dev16",
        "4.6.1.dev18",
        "4.6.1.dev2",
        "4.6.1.dev20",
        "4.6.1.dev21",
        "4.6.1.dev22",
        "4.6.1.dev23",
        "4.6.1.dev24",
        "4.6.1.dev25",
        "4.6.1.dev26",
        "4.6.1.dev27",
        "4.6.1.dev28",
        "4.6.1.dev31",
        "4.6.1.dev32",
        "4.6.1.dev33",
        "4.6.1.dev34",
        "4.6.1.dev35",
        "4.6.1.dev36",
        "4.6.1.dev37",
        "4.6.1.dev38",
        "4.6.1.dev39",
        "4.6.1.dev4",
        "4.6.1.dev40",
        "4.6.1.dev41",
        "4.6.1.dev42",
        "4.6.1.dev43",
        "4.6.1.dev44",
        "4.6.1.dev48",
        "4.6.1.dev49",
        "4.6.1.dev5",
        "4.6.1.dev50",
        "4.6.1.dev51",
        "4.6.1.dev52",
        "4.6.1.dev53",
        "4.6.1.dev54",
        "4.6.1.dev55",
        "4.6.1.dev56",
        "4.6.1.dev57",
        "4.6.1.dev58",
        "4.6.1.dev59",
        "4.6.1.dev60",
        "4.6.1.dev62",
        "4.6.1.dev63",
        "4.6.1.dev64",
        "4.6.1.dev65",
        "4.6.1.dev66",
        "4.6.1.dev67",
        "4.6.1.dev68",
        "4.6.1.dev69",
        "4.6.1.dev7",
        "4.6.1.dev72",
        "4.6.1.dev73",
        "4.6.1.dev74",
        "4.6.1.dev75",
        "4.6.1.dev76",
        "4.6.1.dev77",
        "4.6.1.dev78",
        "4.6.1.dev79",
        "4.6.1.dev80",
        "4.6.1.dev81",
        "4.6.1.dev82",
        "4.6.1.dev84",
        "4.6.1.dev85",
        "4.6.1.dev86",
        "4.6.1.dev87",
        "4.6.1.dev88",
        "4.6.1.dev89",
        "4.6.1.dev9",
        "4.6.1.dev90",
        "4.6.1.dev92",
        "4.6.1.dev93",
        "4.6.1.dev94",
        "4.6.1.dev95",
        "4.6.1.dev97",
        "4.6.1.dev98",
        "4.6.1.dev99"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55013",
    "GHSA-75jv-vfxf-3865"
  ],
  "details": "**Path-Traversal -\u003e Arbitrary File Write in Assemblyline Service Client**\n\n**IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.\n\nSee https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.\n\n---\n\n## 1. Summary  \nThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name.  \n\u003e No validation / sanitisation is performed.\n\nA **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as  \n`../../../etc/cron.d/evil`  \nand force the client to write the downloaded bytes to an arbitrary location on disk.\n\n---\n\n## 2. Affected Versions  \n| Item | Value |\n|---|---|\n| **Component** | `assemblyline-service-client` |\n| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |\n| **Affected** | **All releases up to master branch.**  |\n\n\n---\n\n## 3. CVSS 3.1 Vector \u0026 Score  \n```\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\n```\n\n\n---\n\n## 4. Technical Details\n\n| Field | Content |\n|---|---|\n| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |\n| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |\n| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |\n| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.\u003cbr\u003e2. Client writes the response body to `/etc/cron.d/evil`.\u003cbr\u003e3. Achieves arbitrary file write (code execution if file is executable). |\n\n---\n\n## 5. Impact  \n- **Integrity** \u2013 Overwrite any file writable by the service UID (often root).  \n- **Availability** \u2013 Corrupt critical files or exhaust disk space.  \n- **Code Execution** \u2013 Drop cron jobs, systemd units, or overwrite binaries.\n\n---\n\n## 6. Mitigation / Fix\n\n```python\nimport re\n\n_SHA256_RE = re.compile(r\u0027^[0-9a-fA-F]{64}\\Z\u0027)\n\ndef download_file(self, sha256: str, sid: str) -\u003e Optional[str]:\n    if not _SHA256_RE.fullmatch(sha256):\n        self.log.error(f\"[{sid}] Invalid SHA256: {sha256}\")\n        self.status = STATUSES.ERROR_FOUND\n        return None\n    # or your preferred way to check if a string is a shasum.\n```\n---",
  "id": "PYSEC-2026-1194",
  "modified": "2026-07-07T17:23:47.502955Z",
  "published": "2026-07-07T16:02:58.794662Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55013"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/CybercentreCanada/assemblyline-service-client"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/assemblyline-service-client"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-75jv-vfxf-3865"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code "
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-55013 (GCVE-0-2025-55013)

FKIE_CVE-2025-55013

GHSA-75JV-VFXF-3865

1. Summary

2. Affected Versions

3. CVSS 3.1 Vector & Score

4. Technical Details

5. Impact

6. Mitigation / Fix

PYSEC-2026-1194

1. Summary

2. Affected Versions

3. CVSS 3.1 Vector & Score

4. Technical Details

5. Impact

6. Mitigation / Fix

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour