FKIE_CVE-2025-62487

Vulnerability from fkie_nvd - Published: 2026-01-09 22:16 - Updated: 2026-04-15 00:35
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Summary
On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations). On deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue. On deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group.
References
cve-coordination@palantir.comhttps://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations).\n\n\nOn deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue.\n\n\nOn deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group."
    },
    {
      "lang": "es",
      "value": "El 1 de octubre de 2025, Palantir descubri\u00f3 que las im\u00e1genes subidas a trav\u00e9s de la aplicaci\u00f3n de interfaz (front-end) de Dossier no estaban siendo marcadas correctamente con los niveles de seguridad adecuados. La regresi\u00f3n se rastre\u00f3 hasta un cambio en mayo de 2025, que ten\u00eda como objetivo permitir que las subidas de archivos se compartieran entre diferentes artefactos (por ejemplo, otros dosieres y presentaciones).\n\nEn despliegues configurados con CBAC, la interfaz (front-end) presentar\u00eda un di\u00e1logo de selecci\u00f3n de seguridad para establecer el nivel de seguridad en las subidas, mitigando as\u00ed el problema.\n\nEn despliegues sin una configuraci\u00f3n de CBAC, no aparece ning\u00fan di\u00e1logo de selecci\u00f3n de seguridad, lo que lleva a un nivel de seguridad de CUSTOM sin marcas ni conjuntos de datos seleccionados. Las marcas y grupos resultantes para las subidas de archivos, por lo tanto, ser\u00e1n solo aquellos a\u00f1adidos por las reglas de autorizaci\u00f3n predeterminadas definidas en la configuraci\u00f3n de Auth Chooser. En la mayor\u00eda de los entornos, se espera que las reglas de autorizaci\u00f3n predeterminadas solo a\u00f1adan el grupo Todos."
    }
  ],
  "id": "CVE-2025-62487",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4,
        "source": "cve-coordination@palantir.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-09T22:16:00.260",
  "references": [
    {
      "source": "cve-coordination@palantir.com",
      "url": "https://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f"
    }
  ],
  "sourceIdentifier": "cve-coordination@palantir.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "cve-coordination@palantir.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.