CVE-2025-59711
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An issue was discovered in Biztalk360 before 11.5. Due to mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
Risk Assessment
An attacker can access sensitive system files or perform credential harvesting, threatening data confidentiality and account security.
Recommendation
Upgrade Biztalk360 to version 11.5 or later. Also restrict file upload permissions and implement path validation.
Other vulnerabilities in Biztalk360
See all- CVE-2025-59710High
In Biztalk360 before version 11.5, an access control issue allows any user to request loading a DLL file. During loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution.
- CVE-2025-59709Medium
In Biztalk360 through version 11.5, a Directory Traversal vulnerability exists due to mishandling of user-provided input in a path to be read by the server. A Super User attacker can read files on the system and/or coerce an authentication from the service.
Original NVD description (English source)
An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.