CVE-2025-32779

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32779
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32779.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32779
Aliases
  • GHSA-9v34-frgq-63mv
Published
2025-04-15T16:32:31.992Z
Modified
2025-12-05T08:54:56.230859Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
labsai/eddi Vulnerable to Path Traversal (Zip Slip) in ZIP Import Function
Details

E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the /backup/import API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability. Although the application runs as a non-root user (185), limiting direct impact on system-level files, this vulnerability can still be exploited to overwrite application files (e.g., JAR libraries) owned by the application user. This overwrite can potentially lead to Remote Code Execution (RCE) within the application's context. This issue has been patched in version 5.5.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32779.json"
}
References

Affected packages

Git / github.com/labsai/eddi

Affected ranges

Type
GIT
Repo
https://github.com/labsai/eddi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f14dcafff8141ac73f24c5bd706a11764b78d4da

Affected versions

4.*
4.4.1
4.5.0
dev-4.*
dev-4.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32779.json"