CVE-2025-43515

The issue was addressed by refusing external connections by default. This issue is fixed in Compressor 4.11.1. An unauthenticated user on the same network as a Compressor server may be able to execute arbitrary code.

• CWE-284

• https://support.apple.com/en-us/125693Release Notes, Vendor Advisory
• http://seclists.org/fulldisclosure/2025/Nov/17Third Party Advisory

Published

Nov 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43509This issue was addressed with improved data protection. This…5.5
• CVE-2025-43510A memory corruption issue was addressed with improved lock s…7.8
• CVE-2025-43511A use-after-free issue was addressed with improved memory ma…6.5
• CVE-2025-43512A logic issue was addressed with improved checks. This issue…7.8
• CVE-2025-43513A permissions issue was addressed by removing the vulnerable…5.5
• CVE-2025-43514The issue was addressed with improved handling of caches. Th…5.5
• CVE-2025-43516A session management issue was addressed with improved check…3.3
• CVE-2025-43517A privacy issue was addressed with improved private data red…3.3
• CVE-2025-43518A logic issue was addressed with improved checks. This issue…3.3
• CVE-2025-43519A permissions issue was addressed with additional restrictio…5.5
• CVE-2025-4352A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-43520A memory corruption issue was addressed with improved memory…5.5