CVE-2025-9918: Zip Slip in Google SecOps SOAR allows for Remote Code Execution

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-11 · updated 2026-10-18
Weakness: CWE-22

Description

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution (RCE) via uploading a malicious ZIP archive containing path traversal sequences.

Affected products

Google Cloud Google SecOps SOAR: before 6.3.54.0; before 6.3.53.2 — fixed in 6.3.53.2, 6.3.54.0

How to fix

Upgrade to a fixed version: Google Cloud Google SecOps SOAR 6.3.53.2, 6.3.54.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-9918 or the next vulnerability affects your stack