CVE-2025-9805

A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of the file apps/sim/app/api/proxy/image/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 3424a338b763115f0269b209e777608e4cd31785. Applying a patch is advised to resolve this issue.

• CWE-918

• https://github.com/simstudioai/sim/commit/3424a338b763115f0269b209e777608e4cd31785Patch
• https://github.com/simstudioai/sim/issues/1128Exploit, Issue Tracking, Vendor Advisory
• https://github.com/simstudioai/sim/issues/1128#issue-3349260976Exploit, Issue Tracking, Vendor Advisory
• https://github.com/simstudioai/sim/issues/1128#issuecomment-3226867869Issue Tracking, Patch
• https://vuldb.com/?ctiid.322129Permissions Required, VDB Entry
• https://vuldb.com/?id.322129Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.640821Third Party Advisory, VDB Entry

Published

Sep 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9799A security flaw has been discovered in Langfuse up to 3.88.0…5
• CVE-2025-9800A weakness has been identified in SimStudioAI sim up to ed9b…6.1
• CVE-2025-9801A security vulnerability has been detected in SimStudioAI si…8.1
• CVE-2025-9802A vulnerability was detected in RemoteClinic 2.0. This vulne…5.1
• CVE-2025-9803lunary-ai/lunary version 1.9.34 is vulnerable to an account …8.8
• CVE-2025-9804An improper access control vulnerability exists in multiple …6.5
• CVE-2025-9806A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.…6.4
• CVE-2025-9807The The Events Calendar plugin for WordPress is vulnerable t…7.5
• CVE-2025-9808The The Events Calendar plugin for WordPress is vulnerable t…5.3
• CVE-2025-9809Out-of-bounds write in cdfs_open_cue_track in libretro libre…9.8
• CVE-2025-9810TOCTOU  in linenoiseHistorySave in linenoise allows local at…5.8
• CVE-2025-9811A vulnerability was found in Campcodes Farm Management Syste…9.8