CVE-2025-59709
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
In Biztalk360 through version 11.5, a Directory Traversal vulnerability exists due to mishandling of user-provided input in a path to be read by the server. A Super User attacker can read files on the system and/or coerce an authentication from the service.
Risk Assessment
An attacker with Super User privileges can read arbitrary files on the server, including sensitive data, and potentially coerce authentication from the service, which could lead to further attacks.
Recommendation
Update Biztalk360 to a version newer than 11.5 that contains the fix.
Original NVD description (English source)
An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is able to read files on the system and/or coerce an authentication from the service, aka Directory Traversal.