CVE-2025-7114

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-7114
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7114.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-7114
Published
2025-07-07T05:32:05.686Z
Modified
2026-07-15T01:49:21.148388071Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
SimStudioAI sim Session route.ts POST missing authentication
Details

A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the component Session Handler. The manipulation of the argument Request leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7114.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "37786d371e17d35e0764e1b5cd519d873d90d97b"
                },
                {
                    "last_affected": "37786d371e17d35e0764e1b5cd519d873d90d97b"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/simstudioai/sim

Affected ranges

Type
GIT
Repo
https://github.com/simstudioai/sim
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
805b245ca91951c1e87c93e9c76d4b0128a21798
Database specific 
{
    "cpe": "cpe:2.3:a:sim:sim:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.2.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*
v0.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7114.json"