CVE-2025-59709
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
In Biztalk360 through version 11.5, a Directory Traversal vulnerability exists due to mishandling of user-provided input in a path to be read by the server. A Super User attacker can read files on the system and/or coerce an authentication from the service.
Risk Assessment
An attacker with Super User privileges can read arbitrary files on the server, including sensitive data, and potentially coerce authentication from the service, which could lead to further attacks.
Recommendation
Update Biztalk360 to a version newer than 11.5 that contains the fix.
Other vulnerabilities in Biztalk360
See all- CVE-2025-59711High
An issue was discovered in Biztalk360 before 11.5. Due to mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
- CVE-2025-59710High
In Biztalk360 before version 11.5, an access control issue allows any user to request loading a DLL file. During loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution.
Original NVD description (English source)
An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is able to read files on the system and/or coerce an authentication from the service, aka Directory Traversal.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS