CVE-2025-46559: Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`

Published May 5, 2025
·
Updated

Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in Mk:api allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with ../ to step out of the /api directory, thereby being able to make requests to other endpoints, such as /files, /url, and /proxy. Version 2025.4.1 fixes the issue.

Affected Software

2 affected components
Misskey Misskey>=12.31.0<2025.4.1
Misskey Misskey>=12.31.0<2025.4.1

Event History

May 5, 2025
CVE Published
via MITRE·06:38 PM
Data Sourced
via MITRE·06:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-46559?

CVE-2025-46559 has been classified as having a medium severity due to the potential unauthorized access it enables.

2

How do I fix CVE-2025-46559?

To fix CVE-2025-46559, upgrade to Misskey version 2025.4.1 or later where the validation issue has been addressed.

3

What software is affected by CVE-2025-46559?

CVE-2025-46559 affects Misskey versions from 12.31.0 up to but not including 2025.4.1.

4

What does CVE-2025-46559 allow attackers to do?

CVE-2025-46559 allows attackers to execute unauthorized AiScript code that can access restricted endpoints.

5

Is CVE-2025-46559 a remote vulnerability?

Yes, CVE-2025-46559 is a remote vulnerability, enabling exploitation without physical access to the server.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203