CVE-2025-62498

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version

4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrary code on the machine where the project is opened.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-624994.6Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an CVE-2025-62506.7Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protCVE-2025-625007.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-625018.1SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentialCVE-2025-625034.6User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite CVE-2025-625047.5Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vuCVE-2025-625053.0LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgeryCVE-2025-625068.1MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerabiliCVE-2025-625078.8Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multCVE-2025-625086.5Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored crosCVE-2025-625098.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business lCVE-2025-62516.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all vers
CVE-2025-62498: High severity, CVSS 8.8 | Vulnix