What’s Vulnerable › Vulnerabilities
CVE-2025-11919: Unprotected temporary directories in Wolfram Cloud may result in privilege escalation
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-26 · updated 2026-09-29
Description
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code.
Affected products
References
- https://github.com/PeterRoberge/vulnerability-wolfram-cloud-14.2/blob/main/disclosure.md
- https://www.kb.cert.org/vuls/id/553375
- https://github.com/PeterRoberge/vulnerability-wolfram-cloud-14.2/blob/main/disclosure.md
Get alerted when CVE-2025-11919 or the next vulnerability affects your stack