External risk intelligence

PipesHub Unauthenticated File Write via Path Traversal

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-67506

The vulnerability exists in an API endpoint (/api/v1/record/buffer/convert) of a workplace AI platform. Such platforms are typically deployed as internet-facing services or APIs to facilitate external workflow automation and search capabilities, making this endpoint commonly reachable from the network.

Path Traversal

Pipeshub

0.1.00.1.20.1.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the PipesHub workplace AI platform, affecting how it handles file uploads for document conversion. The issue allows unauthenticated attackers to potentially overwrite or plant arbitrary files on the system, posing a significant security risk.

Unauthenticated file overwrite on the AI platform.
Critical risk impacting data integrity and system security.
Confirm system relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted file upload request to a publicly accessible API endpoint. Because the system does not properly validate filenames before processing them, the attacker can manipulate the filename to include directory traversal sequences. This allows the attacker to overwrite existing files or place new malicious files on the server, potentially leading to unauthorized code execution or system compromise.

Unauthenticated network access is required.
Crafted filename in file upload triggers vulnerability.
Risk of arbitrary file write and code execution.

Live Threat

Current exploitation, exposure, and threat context

The PipesHub platform, when running an unpatched version, could allow an unauthenticated attacker to overwrite arbitrary files on the server by uploading a specially crafted filename. This could occur through the file conversion endpoint that processes uploaded files for conversion to PDF.

Server files could be overwritten.
Crafted filenames could lead to file overwrites.
Arbitrary code execution or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform owners and application teams are likely responsible for addressing this vulnerability in PipesHub. The initial practical step is to identify all deployments of the affected software, confirm their network reachability and business criticality, and then assign an owner for remediation planning.

Identify and prioritize affected systems.
Verify external exposure and business criticality.
Plan and coordinate vendor-supported remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PipesHub?

PipesHub is an extensible AI platform designed for enterprise tasks like internal searching and automated workflows. It includes features that process and convert various documents into PDF format using tools like LibreOffice, which helps organizations manage and integrate data within their operational systems.

What is the vulnerability in CVE-2025-67506?

This vulnerability involves path traversal and improper handling of file types. It occurs because the system fails to check if a filename contains navigation characters like '../' before saving the file to the server. This weakness allows an attacker to escape the intended storage directory and write or overwrite files anywhere the application has system permissions.

How does an attacker trigger this file write flaw?

An attacker triggers this by submitting a specially formatted request to the API's file conversion endpoint. They must provide a filename that includes directory traversal sequences to control where the file is placed. Simple, standard file uploads that do not use these malicious path characters do not trigger the vulnerability, as the risk is specific to the lack of filename normalization.

Is my PipesHub instance at risk according to Halo Surface Signal?

Halo Surface Signal suggests that PipesHub instances are often deployed as internet-facing services to support external workflow automation, increasing the likelihood that this endpoint is reachable from the network. If your platform is accessible from the internet, the risk level is higher because the API does not require authentication to process these requests.

How should I respond to this vulnerability?

The most effective way to secure your environment is to update to version 0.1.0-beta or later, where this issue has been addressed. Before updating, your team should audit your infrastructure to identify all active PipesHub deployments, verify their network reachability, and ensure that a clear ownership plan is in place to prioritize the deployment of the vendor's patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.