Cyber Resilience

CVE-2025-49131

Medium

Published: 09 June 2025

Published
09 June 2025
Modified
29 December 2025
KEV Added
Patch
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0083 75.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49131 is a medium-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Fastgpt Fastgpt. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 25.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as LLM Application Platforms; in the Supply Chain and Deployment risk domain.

EU & UK References

Vulnerability details

FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox container (fastgpt-sandbox) is a specialized, isolated environment used by FastGPT to safely execute user-submitted or dynamically generated code in…

more

isolation. The sandbox before version 4.9.11 has insufficient isolation and inadequate restrictions on code execution by allowing overly permissive syscalls, which allows attackers to escape the intended sandbox boundaries. Attackers could exploit this to read and overwrite arbitrary files and bypass Python module import restrictions. This is patched in version 4.9.11 by restricting the allowed system calls to a safer subset and additional descriptive error messaging.

CWE(s)

AI Security AnalysisAI

AI Category
LLM Application Platforms
Risk Domain
Supply Chain and Deployment
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
Why these techniques?

The vulnerability enables sandbox/container escape (T1611) via permissive syscalls, allowing arbitrary file reads (T1005: Data from Local System) and overwrites (T1565.001: Stored Data Manipulation), plus bypassing Python import restrictions.

Affected Assets

fastgpt
fastgpt
≤ 4.9.11

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-732

Procedures support proper permission assignment for critical resources through documented controls.

addresses: CWE-732

Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.

addresses: CWE-732

Prevents overly permissive assignments to critical resources by limiting to task needs.

addresses: CWE-732

Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.

addresses: CWE-732

Training on permission management reduces incorrect permission assignments for critical resources.

addresses: CWE-732

Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.

addresses: CWE-732

Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.

addresses: CWE-732

Certification includes checking that permissions on critical resources are correctly assigned.

References