CVE-2025-46559

Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with `../` to step out of the `/api` directory, thereby being able to make requests to other endpoints, such as `/files`, `/url`, and `/proxy`. Version 2025.4.1 fixes the issue.

• CWE-22

• https://github.com/misskey-dev/misskey/commit/583df3ec63e25a1fd34def0dac13405396b8b663Patch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-gmq6-738q-vjp2Exploit, Vendor Advisory

Published

May 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46552KHC-INVITATION-AUTOMATION is a GitHub automation script that…6.3
• CVE-2025-46553@misskey-dev/summaly is a tool for getting a summary of a we…6.1
• CVE-2025-46554XWiki is a generic wiki platform. In versions starting from …5.3
• CVE-2025-46556Mantis Bug Tracker (MantisBT) is an open source issue tracke…7.5
• CVE-2025-46557XWiki is a generic wiki platform. In versions starting from …9.8
• CVE-2025-46558XWiki Contrib's Syntax Markdown allows importing Markdown co…9
• CVE-2025-4656Vault Community and Vault Enterprise rekey and recovery key …3.1
• CVE-2025-46560vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2025-46565Vite is a frontend tooling framework for javascript. Prior t…5.3
• CVE-2025-46566DataEase is an open-source BI tool alternative to Tableau. P…9.8
• CVE-2025-46567LLama Factory enables fine-tuning of large language models. …7.8
• CVE-2025-46568Stirling-PDF is a locally hosted web application that allows…7.5