CVE-2025-13433

A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. The attack is only possible with local access. A high complexity level is associated with this attack. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-426
• CWE-428

• https://github.com/lakshayyverma/CVE-Discovery/blob/main/Musehub.md
• https://vuldb.com/?ctiid.332977
• https://vuldb.com/?id.332977
• https://vuldb.com/?submit.687547

Published

Nov 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13425A bug in the filesystem traversal fallback path causes fs/di…1.9
• CVE-2025-13426A vulnerability exists in Google Apigee's JavaCallout polic…8.7
• CVE-2025-13427An authentication bypass vulnerability in Google Cloud Dialo…6.9
• CVE-2025-13428A vulnerability exists in the SecOps SOAR server. The custom…7.2
• CVE-2025-13431The SlimStat Analytics plugin for WordPress is vulnerable to…6.5
• CVE-2025-13432Terraform state versions can be created by a user with speci…4.3
• CVE-2025-13434A weakness has been identified in jameschz Hush Framework 2.…7.5
• CVE-2025-13435A security vulnerability has been detected in Dreampie Resty…8.1
• CVE-2025-13436GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-13437When zx is invoked with --prefer-local=<path>, the CLI creat…5.6
• CVE-2025-13438The Page Title, Description & Open Graph Updater plugin for …4.3
• CVE-2025-13439The Fancy Product Designer plugin for WordPress is vulnerabl…5.9