CVE-2025-9800 Details
Description
A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called 45372aece5e05e04b417442417416a52e90ba174. A patch should be applied to remediate this issue.
A vulnerability exists in the file upload feature of SimStudioAI's 'sim' application, specifically in versions through 'ed9b9ad83f1a7c61f4392787fb51837d34eeb0af'. The issue is located in the 'Import' function of 'apps/sim/app/api/files/upload/route.ts', within the HTML File Parser component. This vulnerability allows for unrestricted uploading of files, particularly HTML files, which can contain malicious scripts. The issue can be exploited remotely and has been made public. The vulnerability arises because the file upload functionality does not properly validate or sanitize uploaded files, especially those containing HTML or script elements.
A patch has been applied in the commit '45372aece5e05e04b417442417416a52e90ba174', which is available for download.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174 | [email protected] | Patch |
| https://github.com/simstudioai/sim/issues/958 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/simstudioai/sim/issues/958#issue-3320696271 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/simstudioai/sim/issues/958#issuecomment-3221311734 | [email protected] | Issue TrackingPatch |
| https://vuldb.com/?ctiid.322115 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.322115 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.641129 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sim sim | <= 0.3.40 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Nov 14, 2025 | Initial Analysis | [email protected] |
| Sep 1, 2025 | New CVE Received | [email protected] |