CVE-2025-12737

HighCVSS 8.4

Published: 03/09/2026(UTC)Updated: 19/10/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.

Risk Assessment

Risk of complete system compromise by a user with administrative privileges, potentially leading to data loss and integrity violation.

Recommendation

Update Carbon Console to a patched version and restrict administrative access to trusted individuals.

Other vulnerabilities in Carbon Console

CVE-2025-6623Medium
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the victim's browser context.

Original NVD description (English source)

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS