CVE-2025-6278

CVE-2025-6278 is a critical path traversal vulnerability affecting Upsonic up to version 0.55.6, specifically within the os.path.join function of the markdown/server.py file. This flaw allows an unauthenticated attacker to manipulate file paths, potentially leading to full compromise of the affected system. With a CVSS score of 9.8 (CRITICAL), it is easily exploitable over the network with low attack complexity, resulting in high impact to confidentiality, integrity, and availability. While not yet added to CISA's KEV catalog or having publicly available exploit code in Metasploit or ExploitDB, the vulnerability has been publicly disclosed and is generating significant community discussion, indicating a high likelihood of future exploitation.