First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-29819

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Windows Admin Center	>= 1809.0, < 2.4.2.1
Microsoft	Windows Admin Center in Azure Portal	>= 1.0, < 0.45.0.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29819Vendor Advisory

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-29826.3A vulnerability, which was classified as critical, was found in Legrand SMS PowerView 1.x. Affected is an unknown function. The manipulation CVE-2025-298207.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-298215.5Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.CVE-2025-298227.8Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.CVE-2025-298237.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-298247.8Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2025-298256.5User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform CVE-2025-298268.8Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over CVE-2025-298278.8Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.CVE-2025-298288.1Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a CVE-2025-298295.5Use of uninitialized resource in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally.CVE-2025-29835.5A vulnerability has been found in Legrand SMS PowerView 1.x and classified as critical. Affected by this vulnerability is an unknown functio

CVE-2025-29819: Medium severity, CVSS 6.2 | Vulnix