CVE-2025-13700
Published: 23 December 2025
Summary
CVE-2025-13700 is a high-severity OS Command Injection (CWE-78) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-13700 is a command injection vulnerability in DreamFactory that permits remote code execution. The flaw resides in the saveZipFile method within the df-core component, where a user-supplied string is passed to a system call without adequate validation. Successful exploitation allows an attacker to run arbitrary commands in the context of the DreamFactory service account. The issue carries a CVSS 3.0 base score of 7.2 and is tracked as CWE-78.
An authenticated remote attacker with high privileges can supply a crafted input to the affected method and achieve code execution on the target system. No user interaction is required beyond the initial authentication, and the attack can be performed over the network.
A patch addressing the vulnerability is available in the df-core repository via commit 404a1783927f95999c71a0ff8f14130d385087fb. The Zero Day Initiative advisory ZDI-25-1024 provides additional technical details and recommends applying the vendor fix.
EPSS for the CVE rose from a low of 0.0123 to a peak of 0.0266, indicating increased exploitation interest after disclosure. No confirmed in-the-wild exploitation has been reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204960
Vulnerability details
DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of DreamFactory. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the saveZipFile method.…
more
The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26589.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.