CVE-2025-46559: Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`
Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in Mk:api allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with ../ to step out of the /api directory, thereby being able to make requests to other endpoints, such as /files, /url, and /proxy. Version 2025.4.1 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46559?
CVE-2025-46559 has been classified as having a medium severity due to the potential unauthorized access it enables.
How do I fix CVE-2025-46559?
To fix CVE-2025-46559, upgrade to Misskey version 2025.4.1 or later where the validation issue has been addressed.
What software is affected by CVE-2025-46559?
CVE-2025-46559 affects Misskey versions from 12.31.0 up to but not including 2025.4.1.
What does CVE-2025-46559 allow attackers to do?
CVE-2025-46559 allows attackers to execute unauthorized AiScript code that can access restricted endpoints.
Is CVE-2025-46559 a remote vulnerability?
Yes, CVE-2025-46559 is a remote vulnerability, enabling exploitation without physical access to the server.