Cyber Resilience

CVE-2025-10854

High

Published: 22 September 2025

Published
22 September 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-10854 is a high-severity UNIX Symbolic Link (Symlink) Following (CWE-61) vulnerability in Jfrog (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, ranked at the 25.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An…

more

attacker is able to write a file anywhere in the filesystem when txtai is used to load untrusted embedding indices

CWE(s)
CWE-61

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Jfrog
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References