CVE-2025-61165

CriticalCVSS 9.8

Published: 26/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to execute arbitrary code via uploading a crafted file.

Risk Assessment

An attacker can execute arbitrary code on the server, potentially leading to full system compromise, data theft, or application takeover.

Recommendation

Update North AI to the latest version that includes a fix for this vulnerability. Restrict access to the file upload endpoint and validate uploaded file types.

Original NVD description (English source)

An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file.