Vulnerability · Published Aug 9, 2025 · Assigned by GitHub_M

CVE-2025-55013Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code

Medium 4.2

In plain English

A medium-severity security flaw in assemblyline from CybercentreCanada. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.6%top 50.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138, the Assemblyline 4 Service Client (task_handler.py) accepts a SHA-256 value returned by the service server and uses it directly as a local file name.A malicious or compromised server (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. This is fixed in version 4.6.1.dev138.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	assemblyline-service-client	4.6.0.stable11	GHSA-75jv-vfxf-3865
PyPI	assemblyline-service-client	4.6.1.dev138	GHSA-75jv-vfxf-3865
PyPI	assemblyline-service-client	4.6.0.stable11, 4.6.1.dev138	PYSEC-2026-1194

Affected products (as reported)

Vendor	Product	Versions
CybercentreCanada	assemblyline	< 4.6.1.dev138

Weakness: CWE-23 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865 x_refsource_CONFIRM
https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900 x_refsource_MISC