CVE-2025-9800
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to SimStudioAI sim applications due to insufficient validation in the HTML File Parser component. Attackers can exploit this to potentially upload malicious files that could lead to further compromise. All instances running affected code commits up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af are vulnerable.
💻 Affected Systems
- SimStudioAI sim
📦 What is this software?
Sim by Sim
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through uploaded malicious files, complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
File upload leading to web shell deployment, data manipulation, or denial of service through resource exhaustion.
If Mitigated
Limited impact with proper file validation, restricted upload directories, and execution prevention controls in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues and the vulnerability database.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 45372aece5e05e04b417442417416a52e90ba174
Vendor Advisory: https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174
Restart Required: No
Instructions:
1. Pull the latest code from the repository. 2. Verify the commit hash includes 45372aece5e05e04b417442417416a52e90ba174. 3. Deploy the updated code to all instances.
🔧 Temporary Workarounds
Implement file upload restrictions
allAdd server-side validation for file types, sizes, and content before processing uploads.
Disable vulnerable endpoint
allTemporarily disable the /api/files/upload endpoint until patching is complete.
🧯 If You Can't Patch
- Implement WAF rules to block suspicious file upload patterns
- Restrict network access to the upload endpoint using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if your codebase includes commit ed9b9ad83f1a7c61f4392787fb51837d34eeb0af or earlier in the git history for the upload component.Check Version:
git log --oneline apps/sim/app/api/files/upload/route.tsVerify Fix Applied:
Verify the commit hash 45372aece5e05e04b417442417416a52e90ba174 is present in your deployment.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Large number of upload requests
- Uploads of unexpected file types
Network Indicators:
- POST requests to /api/files/upload with suspicious payloads
- Unusual outbound connections after uploads
SIEM Query:
source="web_server" AND (uri_path="/api/files/upload" AND (file_extension NOT IN ("jpg","png","pdf") OR file_size > 10485760))🔗 References
- https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174
- https://github.com/simstudioai/sim/issues/958
- https://github.com/simstudioai/sim/issues/958#issue-3320696271
- https://github.com/simstudioai/sim/issues/958#issuecomment-3221311734
- https://vuldb.com/?ctiid.322115
- https://vuldb.com/?id.322115
- https://vuldb.com/?submit.641129
