An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
References
| Link | Resource |
|---|---|
| https://www.synacktiv.com/en/advisories/remote-code-execution-from-any-domain-account-in-biztalk360 | Third Party Advisory |
Configurations
History
09 Apr 2026, 00:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:kovai:biztalk360:*:*:*:*:*:*:*:* | |
| References | () https://www.synacktiv.com/en/advisories/remote-code-execution-from-any-domain-account-in-biztalk360 - Third Party Advisory | |
| First Time |
Kovai
Kovai biztalk360 |
03 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.3 |
| CWE | CWE-22 |
03 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 15:16
Updated : 2026-04-09 00:30
NVD link : CVE-2025-59711
Mitre link : CVE-2025-59711
CVE.ORG link : CVE-2025-59711
JSON object : View
Products Affected
kovai
- biztalk360
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')