Vulnerability · Published Jun 26, 2026 · Assigned by certcc
CVE-2025-11919Unprotected temporary directories in Wolfram Cloud may result in privilege escalation
Critical 9.6
In plain English
A critical-severity security flaw in Cloud from Wolfram Research Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wolfram Research Inc. | Cloud | 14.2 |