CVE-2025-46068 Details
Description
An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism
A vulnerability in Automai Director version 25.2.0 allows remote attackers to execute arbitrary code by exploiting the update mechanism. The issue arises because the update process fails to properly validate or restrict update sources and content, enabling attackers to inject and execute system commands during updates. This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type, and it requires authentication to exploit.
Users are advised to update to the latest version of Automai Director, as the vendor has acknowledged the vulnerability and released a fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/ZeroBreach-GmbH/00ea6cce1299e1d999b5d1faac4248f1 | [email protected] | Third Party Advisory |
| https://www.automai.com/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| automai director | 25.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 21, 2026 | Initial Analysis | [email protected] |
| Jan 12, 2026 | New CVE Received | [email protected] |
| Jan 12, 2026 | CVE Modified | CISA-ADP |