CVE-2025-60950

MediumCVSS 6.1

Published: 30/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

An arbitrary file upload vulnerability exists in the Data Preparation function of AIxBlock commit f60975. Attackers can upload a crafted SVG file to execute arbitrary code.

Risk Assessment

An attacker could upload a malicious file and achieve arbitrary code execution in the application context, potentially leading to system compromise. The risk affects environments with access to the Data Preparation function.

Recommendation

Restrict file uploads and implement file type validation, specifically blocking active content in SVG. Update AIxBlock to a patched version.

Other vulnerabilities in AIxBlock

CVE-2025-63885Medium
A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the model_desc field.

Original NVD description (English source)

An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS