Vulnerability · Published Oct 9, 2025 · Assigned by cisa-cg
CVE-2025-35055Newforma Info Exchange (NIX) insecure file upload
High 8.8
In plain English
A high-severity path traversal in Project Center from Newforma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Official description
Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web server. An attacker can also delete directories. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Newforma | Project Center | 0 – before 2023.1 |
Weakness: CWE-22, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H